# Azure AD Leaver Issue **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** identityiq\ **Created:** [June 8, 2026, 2:57pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951 "2026-06-08T14:57:29Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![manikandaprabhu\_absa](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@manikandaprabhu\_absa](https://developer.sailpoint.com/discuss/u/manikandaprabhu_absa)\ **Post date:** [June 8, 2026, 2:57pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/1 "2026-06-08T14:57:29Z")
When we trigger Leaver as part of Azure AD Unit Testing, we are getting “Response Code - 403 Error - Insufficient privileges to complete the operation” as error. After checking logs and Provisioning Plan, we found Dynamic Groups present which is not allowing to remove other normal Azure AD Groups and getting failed as part of Access Request. @krm7 **-** could you please suggest how can we handle and resolve the issue ? ---
**Author:** ![ryan\_toornburg](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ryan_toornburg/32/21550_2.png) [@ryan\_toornburg](https://developer.sailpoint.com/discuss/u/ryan_toornburg)\ **Post date:** [June 8, 2026, 3:08pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/2 "2026-06-08T15:08:08Z")
Hi @manikandaprabhu_absa - you can use a Before Provisioning rule to look for group removals. Check the managed attribute “groupType” attribute to see if it contains “DynamicMembership”, if so then remove it from the plan. ---
**Author:** ![manikandaprabhu\_absa](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@manikandaprabhu\_absa](https://developer.sailpoint.com/discuss/u/manikandaprabhu_absa)\ **Post date:** [June 8, 2026, 3:09pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/3 "2026-06-08T15:09:54Z")
Hi [Ryan Toornburg](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/2), We have more than 100 Dynamic Groups present which we cannot handle through Before Provisioning Rule. ---
**Author:** ![ryan\_toornburg](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ryan_toornburg/32/21550_2.png) [@ryan\_toornburg](https://developer.sailpoint.com/discuss/u/ryan_toornburg)\ **Post date:** [June 8, 2026, 4:03pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/4 "2026-06-08T16:03:53Z")
@manikandaprabhu_absa - if a user could potentially have a large number of dynamic groups, that would definitely not make sense to try to do that. I believe there was a post awhile back about grouping it into a single query. I will look to see if I can find it unless someone else knows off hand. ---
**Author:** ![narayanag](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/narayanag/32/25441_2.png) [@narayanag](https://developer.sailpoint.com/discuss/u/narayanag)\ **Post date:** [June 8, 2026, 4:58pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/5 "2026-06-08T16:58:58Z")
I agree for this solution. 1. Check the ManagedAttribute attribute such as `groupType` / `groupTypes`. 2. If it contains `DynamicMembership`, remove that AttributeRequest from the plan. [Before Provisioning Rule | SailPoint Developer Community](https://developer.sailpoint.com/docs/extensibility/rules/cloud-rules/before-provisioning-rule/) ---
**Author:** ![manikandaprabhu\_absa](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@manikandaprabhu\_absa](https://developer.sailpoint.com/discuss/u/manikandaprabhu_absa)\ **Post date:** [June 9, 2026, 4:22am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/6 "2026-06-09T04:22:27Z")
Hi @narayanag , We don’t have `groupType`/`groupTypes or`DynamicMembership in the plan. ---
**Author:** ![narayanag](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/narayanag/32/25441_2.png) [@narayanag](https://developer.sailpoint.com/discuss/u/narayanag)\ **Post date:** [June 9, 2026, 4:26am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/7 "2026-06-09T04:26:35Z")
@manikandaprabhu_absa pls share provisiongplan out from logs ---
**Author:** ![narayanag](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/narayanag/32/25441_2.png) [@narayanag](https://developer.sailpoint.com/discuss/u/narayanag)\ **Post date:** [June 9, 2026, 7:34am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/10 "2026-06-09T07:34:03Z")
![image](https://global.discourse-cdn.com/sailpoint/original/3X/8/a/8a7444b7a51bbb850c1fe66b11ad0effe7bb3524.png) Groups are going this way. you can modify your rule accordingly ---
**Author:** ![sukarande](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@sukarande](https://developer.sailpoint.com/discuss/u/sukarande)\ **Post date:** [June 9, 2026, 9:27am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/11 "2026-06-09T09:27:35Z")
@manikandaprabhu_absa Please go through below Post. This may help you. > [@Unable to remove in Azure Entra id through Azure Active Directory connector](https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144/4): > > were you able to figure out the solution? ---
**Author:** ![manikandaprabhu\_absa](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@manikandaprabhu\_absa](https://developer.sailpoint.com/discuss/u/manikandaprabhu_absa)\ **Post date:** [June 9, 2026, 10:24am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/13 "2026-06-09T10:24:06Z")
Hi @narayanag, [Azure AD Dynamic Group Issue.xml](https://developer.sailpoint.com/discuss/uploads/short-url/laRPHbyahogvUDcu8SHVQut97l4.xml) (1.8 KB) Please find the logs files as requested ---
**Author:** ![manikandaprabhu\_absa](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@manikandaprabhu\_absa](https://developer.sailpoint.com/discuss/u/manikandaprabhu_absa)\ **Post date:** [June 9, 2026, 10:33am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/14 "2026-06-09T10:33:52Z")
Hi @sukarande As we have more than 100 dynamic groups in PROD, this will not fix the issue. ---
**Author:** ![SupriyaKantipudi](https://avatars.discourse-cdn.com/v4/letter/s/6f9a4e/32.png) [@SupriyaKantipudi](https://developer.sailpoint.com/discuss/u/SupriyaKantipudi)\ **Post date:** [June 9, 2026, 11:22am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/15 "2026-06-09T11:22:40Z")
Hi @manikandaprabhu_absa Adding to the investigation, I would recommend enabling debug logging in the Azure AD Before Provisioning Rule and reviewing the complete provisioning plan generated during the Leaver process. While the current assumption is that Dynamic Groups are causing the failure, it would be useful to verify exactly which operation is triggering the 403 error. We worked on the issue involving Guest B2B account creation, the initial error message indicated an Azure permission problem like 403 error, but detailed provisioning logs revealed that SailPoint was attempting an unsupported operation (setting password-related attributes for Guest users). Similarly, for this Leaver scenario, the provisioning plan should be reviewed to determine: - Which group memberships SailPoint is attempting to remove. - Whether any Dynamic Groups are included in the request. - Whether the 403 error occurs specifically during the removal of a Dynamic Group or another entitlement operation. - Whether any unsupported attributes or operations are being sent as part of the deprovisioning request. If Dynamic Groups are present in the provisioning plan, Azure AD will reject membership removal requests because Dynamic Group memberships are managed by rules and cannot be modified directly. In that case, logic can be added in the Before Provisioning Rule to identify and exclude Dynamic Groups from deprovisioning operations before the request is sent to Azure. This approach will help confirm the exact root cause and prevent SailPoint from attempting unsupported operations during the Leaver process. ---
**Author:** ![ryan\_toornburg](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ryan_toornburg/32/21550_2.png) [@ryan\_toornburg](https://developer.sailpoint.com/discuss/u/ryan_toornburg)\ **Post date:** [June 9, 2026, 3:37pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/16 "2026-06-09T15:37:03Z")
The overall number of dynamic groups does not really matter. What is important is how many dynamic groups might possibly be removed for your average disable transaction. If it is not a large number then it is not a heavy lift for the Before Rule. In your group schema do you have groupTypes aggregated? ---
**Author:** ![ShaifaliSharma](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@ShaifaliSharma](https://developer.sailpoint.com/discuss/u/ShaifaliSharma)\ **Post date:** [June 9, 2026, 5:06pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/17 "2026-06-09T17:06:10Z")
If you are on IIQ versions \>= 8.5 or 8.4p3 or 8.3p5, you can use the “Group Membership Filter” [Entra ID connector configuration documentation](https://documentation.sailpoint.com/connectors/identityiq/microsoft/entra_id/help/integrating_entra_id/configuration_parameters.html#:~:text=Group%20Membership%20Filters) which will make it so that the group membership of dynamic groups wouldn’t be aggregated into the system. ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [June 17, 2026, 4:32pm UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/18 "2026-06-17T16:32:12Z")
@manikandaprabhu_absa You can also consider having a customization rule to not aggregate the dynamic groups assigned on the users.. In that way, when leaver triggers, it’ll remove all the direct groups and should go through fine. ---
**Author:** ![r\_pragati](https://avatars.discourse-cdn.com/v4/letter/r/41988e/32.png) [@r\_pragati](https://developer.sailpoint.com/discuss/u/r_pragati)\ **Post date:** [June 18, 2026, 4:34am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/19 "2026-06-18T04:34:18Z")
@manikandaprabhu_absa - You can handle which creating the termination provisioning plan. Check if the group type is a **dynamic group** , dont add it to the plan. Try the following code: ```auto Identity identity = context.getObjectByName(Identity.class,identityName); String aadAppName = "Azure AD"; Application aadApp = context.getObject(Application.class, aadAppName); IdentityService is = new IdentityService(context); List aadLinks = is.getLinks(identity, aadApp); List accountReqList = new ArrayList(); for(Link link:aadLinks){ List listOfCubeGroups = new ArrayList(); ProvisioningPlan.AccountRequest acctReq = new ProvisioningPlan.AccountRequest(); acctReq.setApplication(aadAppName); acctReq.setNativeIdentity(link.getNativeIdentity()); acctReq.setOperation(ProvisioningPlan.AccountRequest.Operation.Modify); if (null != link.getAttribute("groups")){ if ((link.getAttribute("groups")) instanceof String) { listOfCubeGroups.add(link.getAttribute("groups")); } else if((link.getAttribute("groups")) instanceof List) { List temp = link.getAttribute("groups"); for (String groupID : temp){ listOfCubeGroups.add(groupID); } } for (String group: listOfCubeGroups){ QueryOptions qoGroup = new QueryOptions(); qoGroup.addFilter(Filter.eq("application.name",aadAppName)); qoGroup.addFilter(Filter.eq("type", "group")); qoGroup.addFilter(Filter.eq("value", group)); qoGroup.setCloneResults(true); Iterator iterator = context.search(ManagedAttribute.class, qoGroup); while (iterator.hasNext()){ ManagedAttribute ma = iterator.next(); if ((null == ma.getAttribute("groupTypes") || !(Util.nullSafeContains(ma.getAttribute("groupTypes"),"DynamicMembership")))){ acctReq.add(new AttributeRequest("groups",ProvisioningPlan.Operation.Remove,group)); } } } } accountReqList.add(acctReq); } ``` ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [August 17, 2026, 4:35am UTC](https://developer.sailpoint.com/discuss/t/azure-ad-leaver-issue/211951/20 "2026-08-17T04:35:10Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.