Skip to main content

How do I remove SCIM-provisioned members who no longer exist in my IdP?

Issue

Former employees were deleted from my identity provider (IdP), so I cannot deprovision them through the IdP. Those users still appear in my Sentry organization as SCIM-managed or pending invited members, and I cannot remove them in the Sentry UI.

Applies To

  • Customers on Business Plan

  • Organizations using SCIM for member provisioning

Resolution

If the user no longer exists in your IdP, remove them from Sentry with the SCIM API.

If the user still exists in your IdP, remove or unassign them there first so SCIM can deprovision them. See Managers/owners can't remove a member not managed through Sentry. Use the steps below only when IdP deprovisioning is no longer possible.

  1. Open Settings > Auth in Sentry and copy the SCIM Auth Token. Enabling SCIM creates this token automatically. It includes the member:admin scope required to delete members. If the token is masked, disable and re-enable SCIM to generate a new token.

  2. List SCIM members to find the member ID. Call the list an organization's SCIM members endpoint. Match the user by email or userName in the response.

  3. Delete the member. Call the delete an organization member via SCIM endpoint with the HTTP DELETE method and the member ID from step 2.

Example:

curl https://sentry.io/api/0/organizations/{organization_id_or_slug}/scim/v2/Users/{member_id} \
  -H 'Authorization: Bearer <auth_token>' \
  -X DELETE

A successful delete returns HTTP 204.

f the delete fails or the member does not appear in the SCIM members list, contact Sentry support.

Related Articles
Did this answer your question?