User Unassigned from a Group

When a user is removed from a group in the Entra SCIM App, Entra triggers a sequence of SCIM operations to update group membership and role assignments in Campaign Manager.

• Check if User Exists via GET /Users: Entra sends a GET /Users request to check if the user exists in Campaign Manager.

• User Deactivation Attempt via PATCH /Users: Entra sends a PATCH request with "active": false to deactivate the user. Campaign Manager skips this operation, as user lifecycle changes are handled through group membership updates.

• Group Info Retrieval via GET /Groups/{id}: Entra fetches the target group details to confirm the user’s membership.

• User Removal from Group via PATCH /Groups/{id}: Entra sends the following PATCH request:

  {
    "op": "Remove",
    "path": "members",
    "value": [{ "value": "<userEmail>" }]
  }

  This indicates that the user is being removed from the specified group.

• Campaign Manager SCIM Logic: If the user has multiple roles, Campaign Manager removes the group from the user’s Roles field and updates the user record. If the user has only this group, Campaign Manager deletes the user entirely.