# Unable to remove in Azure Entra id through Azure Active Directory connector

**URL:** <https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144>\
**Category:** IIQ Discussion and Questions\
**Tags:** identityiq\
**Created:** [July 10, 2025, 1:48pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144 "2025-07-10T13:48:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![SayanthBR2](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@SayanthBR2](https://developer.sailpoint.com/discuss/u/SayanthBR2)\
**Post date:** [July 10, 2025, 1:48pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144/1 "2025-07-10T13:48:30Z")

</div>

Hi All,

We have a requirement to remove the user from all cloud groups (not on-premises AD managed groups) in the Azure Entra application account when the user leaves the organization.

We are using the direct **Azure Active Directory** connector to connect to Azure AD tenant.

When we try to remove these cloud groups, we are receiving the below 403 error:

Error: _ **Response Code - 403 Error - Insufficient privileges to complete the operation** _

We are provided with all the permissions that are necessary to perform this action but still receiving the same error.

The permissions that are provided to our service account are:

**Microsoft graph API permissions** :-

GroupMember.ReadWrite.All (Application)

# Group.ReadWrite.All (Application)

**Service account’s permission** :-

Groups Administrator

User Administrator

Can someone please check on this and let me know if any other permissions need to be assigned or something else can be done here.

Thanks & Regards,

Sayanth

---

<div class="post-metadata">

**Author:** ![tharshith](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tharshith/32/34929_2.png) [@tharshith](https://developer.sailpoint.com/discuss/u/tharshith)\
**Post date:** [July 11, 2025, 11:40am UTC](https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144/2 "2025-07-11T11:40:07Z")

</div>

Hi @SayanthBR2

Try assigning these below permissions to your service account.

- User.ReadWrite.All
- Group.ReadWrite.All

---

<div class="post-metadata">

**Author:** ![SayanthBR2](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@SayanthBR2](https://developer.sailpoint.com/discuss/u/SayanthBR2)\
**Post date:** [July 11, 2025, 12:54pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144/3 "2025-07-11T12:54:11Z")

</div>

Hi Harshith,

Thanks for responding.

The mentioned permissions are already provided but we are still facing the issue.

Please let us know if we have to check something else here.

Regards,  
Sayanth

---

<div class="post-metadata">

**Author:** ![ajmerasunny1](https://avatars.discourse-cdn.com/v4/letter/a/3be4f8/32.png) [@ajmerasunny1](https://developer.sailpoint.com/discuss/u/ajmerasunny1)\
**Post date:** [August 7, 2025, 9:41pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144/4 "2025-08-07T21:41:01Z")

</div>

were you able to figure out the solution?

---

<div class="post-metadata">

**Author:** ![SayanthBR2](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@SayanthBR2](https://developer.sailpoint.com/discuss/u/SayanthBR2)\
**Post date:** [August 11, 2025, 10:06am UTC](https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144/5 "2025-08-11T10:06:41Z")

</div>

The problem was there were dynamic groups in Azure which are auto assigned and removed based on a criterion and Sailpoint cannot remove them.

Identified that after research and wrote a small code in before provisioning rule to filter out that those dynamic groups from plan solved the issue.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [October 10, 2025, 10:07am UTC](https://developer.sailpoint.com/discuss/t/unable-to-remove-in-azure-entra-id-through-azure-active-directory-connector/154144/6 "2025-10-10T10:07:16Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.