> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/getting-started-guide/lifecycle/deprovision-disable.md).

# Deprovision by disabling

Remove access by disabling the Active Directory account instead of deleting it.

**Goal:** delete the test identity in OpenIAM and prove the AD account is **disabled, not deleted**.\
**Time:** 15–20 minutes.\
**Prerequisites:** `poc.provision1` provisioned ([Provision a test account to AD](/getting-started-guide/lifecycle/provision-test-account.md)); `ON_DELETE = DISABLE` on the managed system ([Connect OpenIAM to Active Directory](/getting-started-guide/lifecycle/connect-to-ad.md)).

## Abort criteria — read first

{% hint style="danger" %}
If at any point the connector log shows a **delete** (rather than disable) operation, stop: `ON_DELETE` is not being read. Do not proceed to test against any other account. Recovery for a deleted test account: it's a test account in a disposable OU — recreate it; then fix the attribute (correct name `ON_DELETE`, value `DISABLE`, attached to the AD managed system's resource, managed system not set to Manual) before retrying.
{% endhint %}

{% stepper %}
{% step %}
**Trigger the deprovision**

In the Webconsole, delete the user `poc.provision1` (User Admin → the user → Delete). This is the event: on delete, the provisioning engine consults `ON_DELETE` per target and — because you set `DISABLE` — sends a disable operation to the AD connector instead of a delete.

Organizations handle deletes differently; that's exactly why the flag exists. `DISABLE` (this POC, and the common production choice) suspends the account; `UPDATE` sends an attribute update only; unset means real deletion. A related but separate control: **terminating** (rather than deleting) a user in the Webconsole ends their entitlements, with behavior governed by the workflow setting "when user is getting terminated, remove his access" — worth exploring after the POC.
{% endstep %}

{% step %}
**Verify on all three sides**

1. **AD** — the account still exists and is disabled:

{% code overflow="wrap" %}

```powershell
Get-ADUser poc.provision1 -Properties Enabled
# Expect: the object is returned (NOT deleted), Enabled : False
```

{% endcode %}

2. **Connector log** (Windows host) — shows a disable/modify operation, no delete.
3. **OpenIAM** — audit/log viewer records the operation against the AD managed system.
   {% endstep %}

{% step %}
**The negative proof**

The evidence that makes this POC credible is the pair: the screenshot from [Provision a test account to AD](/getting-started-guide/lifecycle/provision-test-account.md) showing the account existing and enabled, next to today's output showing the same DN present but `Enabled : False`. Capture it.

Optional recovery drill: `Enable-ADAccount poc.provision1` restores the account — demonstrating that disable-based deprovisioning is reversible in a way deletion is not.
{% endstep %}
{% endstepper %}

## If it failed

| Symptom                      | Likely cause                                                                                                                      |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Account was deleted from AD  | `ON_DELETE` missing/misnamed/mis-scoped, or the managed system is Manual (the flag is only honored for automatic managed systems) |
| Nothing happened in AD       | Delete didn't generate a provisioning event — check the audit log; confirm the user actually had the AD identity                  |
| Disable refused by connector | Object outside `PermittedDN`, or service account lacks the right on that OU                                                       |

## You know this worked when…

{% hint style="success" %}
The AD object exists with `Enabled : False`, and logs on both sides show a disable — not a delete.
{% endhint %}

Next: [POC checklist and cleanup](/getting-started-guide/lifecycle/poc-checklist-and-cleanup.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/getting-started-guide/lifecycle/deprovision-disable.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.