You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -24,8 +24,7 @@ The Azure AD provisioning service includes a feature to help avoid accidental de
24
24
The Azure AD provisioning service includes a feature to help avoid accidental deletions. This feature ensures that users aren't disabled or deleted in the target tenant unexpectedly.
25
25
::: zone-end
26
26
27
-
The feature lets you specify a deletion threshold, above which an admin
28
-
needs to explicitly choose to allow the deletions to be processed.
27
+
You use accidental deletions to specify a deletion threshold. Anything above the threshold that you set requires an admin to explicitly allow the processing of the deletions.
29
28
30
29
## Configure accidental deletion prevention
31
30
@@ -50,37 +49,37 @@ threshold.
50
49
51
50
5. Ensure the **Notification Email** address is completed.
52
51
53
-
If the deletion threshold is met, an email will be sent.
52
+
If the deletion threshold is met, an email is sent.
54
53
55
54
6. Select **Save** to save the changes.
56
55
57
-
When the deletion threshold is met, the job will go into quarantine and a notification email will be sent. The quarantined job can then be allowed or rejected. To learn more about quarantine behavior, see [Application provisioning in quarantine status](application-provisioning-quarantine-status.md).
56
+
When the deletion threshold is met, the job goes into quarantine, and a notification email is sent. The quarantined job can then be allowed or rejected. To learn more about quarantine behavior, see [Application provisioning in quarantine status](application-provisioning-quarantine-status.md).
58
57
59
58
## Recovering from an accidental deletion
60
-
If you encounter an accidental deletion, you'll see it on the provisioning status page. It will say **Provisioning has been quarantined. See quarantine details for more information**.
59
+
When you encounter an accidental deletion, you see it on the provisioning status page. It says `Provisioning has been quarantined. See quarantine details for more information`.
61
60
62
61
You can click either **Allow deletes** or **View provisioning logs**.
63
62
64
63
### Allowing deletions
65
64
66
-
The **Allow deletes** action will delete the objects that triggered the accidental delete threshold. Use the following procedure to accept the deletes.
65
+
The **Allow deletes** action deletes the objects that triggered the accidental delete threshold. Use the procedure to accept the deletions.
67
66
68
67
1. Select **Allow deletes**.
69
68
2. Click **Yes** on the confirmation to allow the deletions.
70
-
3.You'll see confirmation that the deletions were accepted and the status will return to healthy with the next cycle.
69
+
3.View the confirmation that the deletions were accepted. The status returns to healthy with the next cycle.
71
70
72
71
### Rejecting deletions
73
72
74
-
If you don't want to allow the deletions, you need to do the following:
73
+
Investigate and reject deletions as necessary:
75
74
- Investigate the source of the deletions. You can use the provisioning logs for details.
76
75
- Prevent the deletion by assigning the user / group to the application (or configuration) again, restoring the user / group, or updating your provisioning configuration.
77
76
- Once you've made the necessary changes to prevent the user / group from being deleted, restart provisioning. Don't restart provisioning until you've made the necessary changes to prevent the users / groups from being deleted.
78
77
79
78
80
79
### Test deletion prevention
81
-
You can test the feature by triggering disable / deletion events by setting the threshold to a low number, for example 3, and then changing scoping filters, un-assigning users, and deleting users from the directory (see common scenarios in next section).
80
+
You can test the feature by triggering disable / deletion events by setting the threshold to a low number, for example 3, and then changing scoping filters, unassigning users, and deleting users from the directory (see common scenarios in next section).
82
81
83
-
Let the provisioning job run (20 – 40 mins) and navigate back to the provisioning page. You'll see the provisioning job in quarantine and can choose to allow the deletions or review the provisioning logs to understand why the deletions occurred.
82
+
Let the provisioning job run (20 – 40 mins) and navigate back to the provisioning page. Check the provisioning job in quarantine and choose to allow the deletions or review the provisioning logs to understand why the deletions occurred.
84
83
85
84
## Common deprovisioning scenarios to test
86
85
- Delete a user / put them into the recycle bin.
@@ -93,15 +92,15 @@ To learn more about deprovisioning scenarios, see [How Application Provisioning
93
92
## Frequently Asked Questions
94
93
95
94
### What scenarios count toward the deletion threshold?
96
-
When a user is set to be removed from the target application (or target tenant), it will be counted against the
95
+
When a user is set for removal from the target application (or target tenant), it's counted against the
97
96
deletion threshold. Scenarios that could lead to a user being removed from the target
98
97
application (or target tenant) could include: unassigning the user from the application (or configuration) and soft / hard deleting a user in the directory. Groups
99
98
evaluated for deletion count towards the deletion threshold. In addition to deletions, the same functionality also works for disables.
100
99
101
100
### What is the interval that the deletion threshold is evaluated on?
102
101
It's evaluated each cycle. If the number of deletions doesn't exceed the threshold during a
103
-
single cycle, the “circuit breaker” won’t be triggered. If multiple cycles are needed to reach a
104
-
steady state, the deletion threshold will be evaluated per cycle.
102
+
single cycle, the “circuit breaker” isn't triggered. If multiple cycles are needed to reach a
103
+
steady state, the deletion threshold is evaluated per cycle.
105
104
106
105
### How are these deletion events logged?
107
106
You can find users that should be disabled / deleted but haven’t due to the deletion threshold.
0 commit comments