> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/deprovision-identity.md).

# Deprovision Account

Disable or suspend user accounts while preserving audit trails.

Disables or suspends user accounts in target systems when employees or contractors leave the organization. Unlike [Delete Account](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/delete-identity.md), which permanently removes accounts, Deprovision Account preserves the account and its audit history while revoking access — allowing for potential reactivation if needed.

**Example Use Cases:**

* Disable Active Directory accounts and move leavers to a terminated users OU
* Suspend Okta accounts while preserving group membership history for audit
* Revoke access and reassign resources when employees transition out of the organization
* Lock accounts during investigations while maintaining forensic records

{% hint style="warning" %}
**Deprovision versus Delete**: Use Deprovision Account when you need to preserve audit trails, might need to reactivate accounts, or must comply with retention policies. Use [Delete Account](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/delete-identity.md) when you need permanent removal (for example, a GDPR right-to-be-forgotten request or database user cleanup). For Active Directory Managed Service Accounts, Deprovision Account only disables the account and leaves its group memberships, OU, and other attributes unchanged. See [Managed Service Accounts](/4yItIzMvkpAvMVFAamTf/integrations/integrations/active-directory/provisioning.md#managed-service-accounts).
{% endhint %}

### Deprovisioning methods

The exact deprovisioning behavior depends on the target application and the method configured in the action. Integrations may support one or more of the following:

| Method      | Description                                                                    | Example                                                            |
| ----------- | ------------------------------------------------------------------------------ | ------------------------------------------------------------------ |
| **Disable** | Disables the account login while preserving the account and its data           | Active Directory: disables the account; Okta: deactivates the user |
| **Suspend** | Temporarily suspends the account (may be reversible without full reactivation) | Okta: suspends the user session                                    |

Not all integrations support both methods. The **Deprovision Type** dropdown lists the methods the integration supports, and appears only when more than one is available.

| Setting                                 | Description                                                                                                                                 |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Entity Type                             | The data source and target entity type to deprovision                                                                                       |
| Deprovision Type                        | The deprovisioning method to use (Disable or Suspend, depending on the integration)                                                         |
| Remove all entitlements                 | Whether to remove existing group memberships and role assignments. Use **Entitlements Excluded from Removal** to keep specific entitlements |
| Entitlements to Add                     | Entitlements to assign after deprovisioning (e.g., move to a "Terminated Users" group)                                                      |
| End all active sessions for the account | Force-terminate active sessions after deprovisioning (supported integrations only)                                                          |
| Shared Attribute Mappings               | Shared transformation rules across multiple deprovisioning actions                                                                          |
| Action Attribute Mappings               | Target attributes to update during deprovisioning (e.g., update `distinguished_name` to a terminated OU)                                    |

See the [example deprovisioning workflow](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions.md#sync-active-directory-attributes-for-withdrawn-employees-leavers) in the Actions overview for a complete Active Directory offboarding configuration.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/deprovision-identity.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.