How do you manage users who has left?

Hello May,

We have the same/similar issue and have tried to address this since earlier this year.  We use groups to assist with assigning access.  The automated process through Keycloak works to get users added but has no means in which to remove a user that is removed from Azure/SSO There is no automated process to remove a user as it stands today.  As a matter of fact Ataccama instructed us to disable the users versus deleting the users. Not our preference.  

Ah yes. When I say manually remove users I mean unassign them from roles. But yes I was hoping some sort of automated unassigning of roles.

Product managers if you are seeing this, can we have it on a wish list if it is not already?

hi ​@may_kwok ,
If I understand your requirement correctly i believe what you want is possible if all the roles the user is assigned to are granted through sync with AD. Typically when configuring mappers for automated role assignment during SSO authentication you can set Sync policy to FORCE which will synchronize user roles during SSO login. Roles that have mappers can either be granted or revoked this way (if user has a role in AD, it will be granted in Keycloak, and if the user has a role in Keycloak that has a mapper while not having it in AD - it will be removed). Roles that have no configured mappers won’t be affected. The sync would happen only on login with SSO.

I think that's the kicker. The sync only happens on login with SSO.

A leaver is not going to login to ataccama after their roles or their account have been disabled. Helping an IT team tidy up permissions of an application is the last thing on this person's mind 😅. 

Ideally there is some way of initiating something to get all roles from existing keycloak users from azure AD? Is that possible at all?

​@may_kwok yes, that’s true, it’s probably more suitable to keep the role assignments up to date, but maybe not so good for cleanup if the user leaves. I guess one additional option might be to utilize the Keycloak and MS Entra API’s, reading users and their roles/groups from both sides. Looking for users which are no longer in Entra and removing them from Keycloak. While mappers can help user access to stay up to date, this way you can also remove the obsolete users.

It appears that latest versions of Keycloak also brought Workflows feature that might enable some level of cleanup automation:
https://www.keycloak.org/2025/10/workflows-experimental-26-4