'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Configure Entra ID SSO to Revoke Access to External Apps Like Jira
Question details
The user wants to know if disabling an account in Microsoft Entra ID automatically revokes access to external SAML/SSO applications such as Jira.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Managing user offboarding to ensure that access to third-party SSO applications is immediately and securely revoked.
- Observed behavior
- Seeking confirmation on whether disabling the user account is sufficient, or if additional SAML claims and app provisioning steps are required to terminate active sessions.
Ensure you have Global Administrator or Conditional Access Administrator privileges in Microsoft Entra ID to view and modify enterprise application provisioning and access policies.
Configure Automatic User Provisioning for External Apps
Setting up automatic user provisioning ensures that disabling a user in Entra ID immediately deactivates them in connected external SAML applications.
Disabling a user account blocks new SSO sign-ins, but existing sessions in the external app may remain active until the token expires. Automatic provisioning actively sends a deactivation signal to the external app.
Sign in to the Microsoft Entra admin center, navigate to Identity, expand Applications, and select Enterprise applications.
Search for and select the external application you wish to manage, such as Jira.
Click on Provisioning in the left menu, change the Provisioning Mode to Automatic, and provide the necessary admin credentials for the external app.
Ensure the mapping rules are set to sync the account status so that when an account is disabled in Entra ID, the corresponding user in the external app is also suspended.
Consult the Microsoft Entra ID Q&A Community
For complex SAML claim routing or apps that do not support automatic provisioning, consult Microsoft experts for custom access policy guidance.
Looking for a Reliable and Cost-Effective Office Suite?
Managing enterprise software costs and IT integrations can be complex. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office, ensuring seamless productivity for your teams without the heavy licensing overhead.
- 1. Download the Installer: Visit the WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the setup file and follow the on-screen instructions for a quick, lightweight installation.
- 3. Start Creating: Open WPS Office to effortlessly view, edit, and save Microsoft Office compatible documents.
Frequently Asked Questions
Does disabling a user in Entra ID immediately end active sessions in external apps?
Not inherently. While disabling the user prevents new sign-ins via SSO, existing sessions in external SAML apps like Jira may remain active until the session timeout is reached. To ensure immediate termination, the app must support Continuous Access Evaluation (CAE) or automated SCIM provisioning.
How can I forcefully revoke sessions for a specific user?
You can go to the user's profile in the Microsoft Entra admin center and click 'Revoke sessions'. This invalidates the user's refresh tokens, forcing them to re-authenticate. However, external SAML apps may still rely on their own internal session timers.
Do I need a premium license for automatic user provisioning?
Basic SSO configuration is free, but automating user provisioning (SCIM) to third-party applications often requires an Entra ID P1 or P2 license depending on the specific application's enterprise gallery requirements.
