Problem

Users are missing from lists in Freshservice, or many users were deactivated, and nobody did it.

Cause

SCIM never deletes users. It deactivates them, and only when Microsoft Entra ID tells it to. Check these three causes:

  1. The user was disabled or soft-deleted in Microsoft Entra ID.
  2. The user or their group was removed from Users and groups in the app.
  3. The scope was changed from "Sync all users and groups" to "Sync only assigned users and groups", or a scope filter no longer matches.

Steps

  1. Open the provisioning logs in Microsoft Entra ID for the affected users and check which of the three happened (see How to Read Provisioning Logs and Find the Cause of an Error).
  2. Fix it in Microsoft Entra ID: assign the user or group again, restore the scope setting, or re-enable the user.
  3. Wait for the next cycle, or run Provision on demand, to reactivate. You can also reactivate users by hand in Freshservice.
  4. If Microsoft Entra ID says too many deletions are pending (accidental deletion threshold), raise the threshold for one cycle, let it run, then lower it again.
  5. If the Freshservice Audit Log shows a person or another tool as the actor, SCIM did not do it.

Good to know

  • A reactivated agent comes back as an Occasional Agent. Assign their original role again. Until then, Occasional Agent day-pass limits apply.
  • A permanent delete in Microsoft Entra ID sends no request. The Freshservice user stays active until you deactivate them.
  • When an agent is deactivated, Freshservice unassigns their tickets and clears the department. This is Freshservice behavior.
  • SCIM actions appear in the Audit Log under the account that installed the app.
  • To stop deactivations, delete the active mapping in Provision Microsoft Entra ID Users (source Not([IsSoftDeleted]), target active). You then deactivate leavers by hand.
  • With Okta, the native app does not deactivate users. See Okta Provisioning for Freshservice: Common Fixes.

Sources

  • KB: How to Read Provisioning Logs and Find the Cause of an Error
  • KB: Okta Provisioning for Freshservice: Common Fixes