Description:

This step removes one or more users from a Microsoft Entra ID group.

The Remove Users From EntraID Group workflow step connects to Microsoft Entra ID (formerly Azure Active Directory) and removes one or more existing users from a specified security or Microsoft 365 group.

The step accepts a row-delimited list of usernames, allowing multiple users to be removed from the group in a single workflow step.

The step supports:

• Microsoft Entra ID group membership management
• Removing multiple users in a single operation
• Configurable Entra ID connections
• Dynamic username lists using workflow variables
• Integration with Microsoft Graph through FlowWright connections

This step can be used for:

• Employee offboarding
• Department transfers
• Project team changes
• Temporary access removal
• Security group management
• Identity lifecycle management
• Business process automation

Usage:

The Remove Users From EntraID Group step is typically placed after employee information has been updated or approved within a workflow.

The workflow can dynamically populate the group name and user list using workflow variables, form fields, HR systems, or data retrieved from external applications.

Once the users have been removed from the group, later workflow steps can:

• Add users to a different group
• Assign new application roles
• Update security permissions
• Notify administrators
• Synchronize downstream systems
• Continue employee lifecycle workflows

You need to set up an EntraID connection. Go to Integration > Connections > Generic Connections. On the Manage Generic Connections page, click Actions > Create. A sample connection is included here for reference. 

Example:

Let’s build and execute the “clsRemoveUsersFromEntraIDGroupDef” example:

• Create a new process definition named “clsRemoveUsersFromEntraIDGroupDef” and open it in designer mode. 
• Drag a “clsRemoveUsersFromEntraIDGroup” step to the canvas.
• Connect the dots between the “Start” and “clsRemoveUsersFromEntraIDGroup” steps.
• Click the "clsRemoveUsersFromEntraIDGroup" step to configure its "Required" properties. Provide a name for the step. Select the EntraID connection from the drop-down list. Provide the “Group Name”. Click the button to add multiple “Usernames”. Click the Save button. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• Click the button to add multiple “Usernames”. A pop-up is rendered for configuration. Click the Add Row (+) button to insert an empty row. Provide the “Username”. Click the Save button. You may insert multiple user names by using the Add Row button.  

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Remove Users From Group step, FlowWright connects to the configured Microsoft Entra ID tenant and removes the specified users from the selected group. If all users are successfully removed, the workflow follows the True return path. If one or more users cannot be removed—for example, because the group does not exist, a user cannot be found, or the connection is unavailable—the workflow follows the False return path.

Tips:

• Verify that the Microsoft Entra ID connection has been configured before using this step.
• Use workflow variables to dynamically populate the group name and user list.
• Enter one username (User Principal Name) per line.
• Verify that the specified group exists before executing the workflow.
• Ensure that the users are members of the group before attempting to remove them.
• Use the True and False return paths to implement appropriate success and error handling.
• Combine this step with Add Users To Group or role assignment steps when automating department transfers.

Notes:

• A valid Microsoft Entra ID connection must exist before this step can execute.
• The configured connection must have sufficient Microsoft Graph permissions to manage group memberships.
• The specified group and user accounts must already exist in Microsoft Entra ID.
• Invalid group names or usernames may cause the operation to fail.
• Network connectivity or authentication issues may prevent successful removal.
• The workflow should include appropriate error handling for the False return path.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• Microsoft Entra ID connection
• Group name mapping
• Username list mappings
• Workflow variable mappings
• Microsoft Graph permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.