> ## Documentation Index
> Fetch the complete documentation index at: https://support.i.moneyforward.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure an offboarding workflow via Entra ID

> Learn how to configure a workflow that disables the Microsoft Entra ID account of a departing employee and unassigns the apps you choose.

This page explains how to configure a workflow that disables the Microsoft Entra ID account of a departing employee. The workflow then unassigns the apps you choose. Use the template "Offboarding via Entra ID (App Unassignment)".

> [!NOTE]
>
> Microsoft Entra ID (Azure AD) is the only identity provider supported at present.

## Configuration flow

After completing the [prerequisites](https://support.i.moneyforward.com/en/it-management/workflows/90k8f1lee0-workflows.md), configure the workflow in three main steps.

1. [**Identity provider integration (Entra ID)**](https://support.i.moneyforward.com/en/integrations/4l37o2sowt-idp-entraid.md): Connect Entra ID and link your apps to services.
2. [**Configure automation mapping**](https://support.i.moneyforward.com/en/it-management/workflows/ms4wo45v27-admina-automation-wic.md): Set up the mapping with Microsoft Entra ID.
3. [**Create and publish the workflow**](#offboarding-steps): Create the workflow from the template. Then set the conditions, services, apps, and notifications.

## How the workflow runs

The template runs the following steps from top to bottom.

| Step | Description |
| - | - |
| Event Trigger | Starts when a retired employee leaves. |
| Conditions | Narrows down the target employees. |
| Entra ID Deprovision | Deactivates or deletes the Entra ID account, based on the deprovision type. The available types differ by service. |
| App Unassignment | Unassigns the apps you choose. |
| Notification | Sends a notification by Slack or email. |

Under "Services to delete accounts from", App Unassignment follows Entra ID. App Unassignment runs after the Entra ID deprovision.

## Steps to configure offboarding via Entra ID

1. Go to **Automation** > **\[Create workflow]** > **\[Offboarding via Entra ID (App Unassignment)]**.

   ![The Offboarding via Entra ID (App Unassignment) automation template card](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/template-card.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=0d136d14b283d1a8a79743bea23895f2)

2. On the builder screen, click **"1. Event Trigger"** and set **"Execution Schedule"**. The template runs the workflow 1 day after the contract end date.

   ![Execution Schedule on the 1. Event Trigger screen, set to 1 day after the contract end date](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/event-trigger-schedule.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=ab4d78c17dea0d989acdab20f6394f95)

3. Click **"2. Conditions"** and set the conditions for target employees. The template targets full-time employees.

   The available items are the same as in "2. Conditions" in [Configure an offboarding workflow](https://support.i.moneyforward.com/en/it-management/workflows/clsb6alwrc-admina-automation-rtp.md).

   ![The 2. Conditions screen with the contract end date and employee type set](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/conditions.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=7c6b726aad2c89a52035245e7f2d172c)

4. Under **"3. Services to delete accounts from"**, set up Microsoft Entra ID.

   1. Click the Microsoft Entra ID step to open its **"Settings"** panel on the right. Select the workspace name from the **"Service settings - Workspace name"** dropdown.

      ![The Entra ID Settings panel with the workspace name field and the Deprovision Type, before you select a workspace](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/entra-service-settings.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=c13ac492ba127c023e44329c33206eda)

   2. Check the **"Deprovision Type"**. The available types depend on the service, and unavailable types are grayed out.

      | Deprovision Type | Description |
      | - | - |
      | **Deactivate** | The account is deactivated and can no longer sign in to the workspace or service. The data remains. |
      | **Delete** | The account is deleted from the workspace or service, and all related data is deleted. |

      If you select none here, the deprovision type set on the connection applies.

      > [!WARNING]
      >
      > If you can select "Delete" and do so, the Entra ID account and its data are deleted. For the difference between disabling and deleting, see [Disable and delete Entra ID users](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-id-lifecycle.md).

      ![The Deprovision Type with Delete selected as an example, after you select a workspace](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/deprovision-type.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=19f552d765ce625ea89e46357429d80a)

   3. In the same group, click **"App Unassignment"** and set the following items.

      | Item | Description |
      | - | - |
      | **Identity provider workspace** | Select the Entra ID workspace. |
      | **Managed apps** | Select the apps to unassign. You can select 1 to 200 apps. Each app shows **SCIM active**, **SCIM inactive**, or **SCIM unknown**. |

      > [!NOTE]
      >
      > If "No managed apps are available. Add apps to this identity provider before configuring this action." appears, first link your apps to services in [Identity provider integration (Entra ID)](https://support.i.moneyforward.com/en/integrations/4l37o2sowt-idp-entraid.md).

      ![The App Unassignment settings with the Identity provider workspace field](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/app-unassignment-settings.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=3da4c2e07da7c000d8122e7079e817b9)

5. Click **"4. Notification"**, click **\[+ Add Notification]**, and set the notification method: **Slack** or **Email**. The steps are the same as "4. Notification" in [Configure an offboarding workflow](https://support.i.moneyforward.com/en/it-management/workflows/clsb6alwrc-admina-automation-rtp.md).

   ![The + Add Notification button under 4. Notification](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/notification.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=985b5f61a4c6e6b0d038c2f0c56daaf4)

6. After all settings are complete, all checks in the builder turn green. Click **\[Publish]** or **\[Dry Run]**.

   For details on dry runs, see [Dry-run a workflow](https://support.i.moneyforward.com/en/it-management/workflows/cmeu7hzi90-workflow-cww.md). In a dry run, the App Unassignment result reads "Removed the app assignment from the IdP account".

   ![The Dry Run and Publish buttons and a green check highlighted](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/publish-dry-run.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=c75c3987fcc629d5c873c82ffa10a7e5)

7. The **"Confirm workflow automation settings"** screen appears. Enter the workflow name and click **\[Publish]**.

   Note: You cannot use a name that is already registered.

   ![The workflow name field on the Confirm workflow automation settings screen](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/confirm-workflow-name.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=3175c40348b848812bd766635e558f88)

8. When **"Workflow has been published"** appears, click **\[OK]**.

   ![The Workflow has been published message](https://mintcdn.com/moneyforwardi/et3M9uaK70qLAFWL/images/it-management/workflows/entraid-offboarding-workflow/publish-complete.png?fit=max\&auto=format\&n=et3M9uaK70qLAFWL\&q=85\&s=8a437a1c204c173eb61430d98e95a83d)

## Messages shown when you save or publish

For the messages shown when you save or publish, see [Check Entra ID assignment status and errors](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-assignment-status.md#automation-troubleshooting).

You cannot delete the Entra ID step of the template. To build a workflow without Entra ID, create it from scratch. For details, see [Create a workflow from scratch](https://support.i.moneyforward.com/en/it-management/workflows/tge7rgoibt-workflow.md).

## Check the results

When the workflow runs, it requests the unassignment for each selected app.

* If one app fails, the unassignments for the other apps continue.
* An app the employee is not assigned to does not fail. The workflow completes without any change for that app.
* App Unassignment does not delete the Entra ID account itself. The Deprovision Type of the Entra ID Deprovision step decides what happens to the account.

Even after you unassign an app, the account on the app side may remain. To check "Unassigned apps - needs review", see [Check Entra ID assignment status and errors](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-assignment-status.md#unassigned-apps-need-review).

You can check the results on the **Runs** and **Logs** tabs. For when the workflow runs, see [Onboarding and offboarding automation flow](https://support.i.moneyforward.com/en/it-management/workflows/n2msl3q9um-admina-automation.md).

## Related pages

* [Assign and unassign apps with Entra ID](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-app-assignment.md)
* [Disable and delete Entra ID users](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-id-lifecycle.md)
* [Check Entra ID assignment status and errors](https://support.i.moneyforward.com/en/it-management/idp-account-management/entraid-assignment-status.md)
* [Configure an onboarding workflow via Entra ID](https://support.i.moneyforward.com/en/it-management/workflows/entraid-onboarding-workflow.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.