Anyone having problems with accounts not disabling after Azure AD provisioning is configured?

Question

We have configured Azure AD provisioning for our Service Desk tenant.  Service Desk accounts are being created when new users are being assigned to the Service Desk application integration within Azure.  When an employee leaves the organization, Azure AD is being updated via synchronization with local Active Directory.  The status of the user changes from Enabled to Disabled.  My understanding is that the Service Desk user account is supposed to be updated from Active to Disabled.  That is not working for us?

Anybody have any experience with how disabling users is supposed to work with Azure AD integration with Service Desk?

john_morse · Answer

Here's a screenshot of the error we get when we try to take a disabled user in Azure AD and provision them on demand in order to update the status in Service Desk:

SPSDude · Answer

Howdy y'all!

@michael.clark, I recently worked with @john_morse and everything looks good between the systems. It seems the provisioning is being SKIPPED on the Azure side for these specific users due to an entitlement. I advised John to reach out to support as well, but hoping someone from the community may know if there is a specific "order of operations" that AD users need to be disabled in order for provisioning to sync them all the way across from AD>Azure>SWSD.

michael.clark · Answer

Hello there @john_morse!  The expected behavior is if a user is Disabled in AD/Azure, the account is disabled in SWSD.  Have you opened a ticket at servicedesksupport@solarwinds.com for this issue?  This will allow the team to check logs and may ask for Azure configuration screenshots.