Description:

This step disables an existing Microsoft Entra ID user account.

The Disable EntraID User workflow step connects to Microsoft Entra ID (formerly Azure Active Directory) and disables an active user account within the configured tenant.

The step identifies the user by the specified User Principal Name (UPN) and disables the account, preventing the user from signing in while preserving the account and its associated resources for future reactivation if required.

The step supports:

• Microsoft Entra ID user account disablement
• Configurable Entra ID connections
• User lookup by User Principal Name (UPN)
• Automated account deactivation
• Integration with Microsoft Graph through FlowWright connections

This step can be used for:

• Employee offboarding
• Temporary account suspension
• Leave of absence processing
• Contractor deactivation
• Identity lifecycle management
• User account administration
• Business process automation

Usage:

The Disable EntraID User step is typically placed after an approval or verification step in a workflow that removes or suspends user access.

The workflow disables the specified Microsoft Entra ID user account using the configured connection.

Once the user account has been disabled, later workflow steps can:

• Remove the user from security groups
• Revoke application access
• Archive user data
• Notify administrators
• Synchronize downstream systems
• Continue identity lifecycle management processes

You need to set up an EntraID connection. Go to Integration > Connections > Generic Connections. On the Manage Generic Connections page, click Actions > Create. A sample connection is included here for reference. 

Example:

Let’s build and execute the “clsDisableEntraIDUserDef” example:

• Create a new process definition named “clsDisableEntraIDUserDef” and open it in designer mode. 
• Drag a “clsDisableEntraIDUser” step to the canvas.
• Connect the dots between the “Start” and “clsDisableEntraIDUser” steps.
• Click the "clsDisableEntraIDUser" step to configure its "Required" properties. Provide a name for the step. Select the EntraID connection from the drop-down list. Enter the “Username”. Click the Save button. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Disable User step, FlowWright connects to the configured Microsoft Entra ID tenant and attempts to disable the specified user account. If the account is successfully disabled, the workflow follows the Disabled return path. If the user cannot be found, the account cannot be disabled, or the connection cannot be established, the workflow follows the NotDisabled return path.

Tips:

• Verify that the Microsoft Entra ID connection has been configured before using this step.
• Use workflow variables to dynamically specify the User Principal Name (UPN).
• Verify that the specified user account exists before attempting to disable it.
• Use this step as part of employee offboarding, temporary suspension, or security response workflows.
• Use the Disabled and NotDisabled return paths to implement appropriate success and error handling.
• Combine this step with group membership removal, license revocation, or notification steps to fully automate user deactivation.

Notes:

• A valid Microsoft Entra ID connection must exist before this step can execute.
• The configured connection must have sufficient Microsoft Graph permissions to update user account status.
• The specified User Principal Name (UPN) must already exist in Microsoft Entra ID.
• Disabling a user prevents sign-in but does not delete the account or its associated resources.
• Network connectivity or authentication issues may prevent successful account deactivation.
• The workflow should include appropriate error handling for the NotDisabled return path.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• Microsoft Entra ID connection
• Username mapping
• Workflow variable mappings
• Microsoft Graph permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.