Skip to content

Disable or remove an identity provider

Stop your members signing in through your tenant's identity provider, either for now (disable) or for good (delete).

Who can do it

A tenant administrator or a tenant access administrator, or a platform super administrator working inside your tenant, holding the permission to configure identity federation. A person who can only read the providers sees them with Disable and Delete disabled and a sentence saying why.

Withdrawing a provider does not depend on your edition: a tenant whose edition no longer includes federation can still disable or delete the providers it holds. On a customer-operated deployment, the platform operator must have delegated identity federation to your tenant.

Before you start

  • Decide which one you need:
    • Disable is reversible. The configuration and its last self-test are kept, so you can enable the provider again without declaring it anew.
    • Delete is permanent. It is also the only way to correct a declared provider, because a provider cannot be edited.
  • Deleting a provider also removes every group mapping, admission rule and sign-in domain guard declared for it, unbinds every account that signs in through it (the account and its password are kept, its link to the provider is removed and its sessions end; unbinding gives no account a usable password, and a member set to sign in through the identity provider only stays set that way), drops pending account-link invitations that name it, destroys its stored secret, and frees its protocol so you can declare a new one.
  • If the deletion would leave your tenant with no account able to sign in, it is refused. Create or activate a local administrator first.
  • Both actions take a reason, recorded in the audit trail, and ask for a recent sign-in.

Steps

  1. Open Settings and select the Integrations tab.
  2. On the Identity federation row, select Manage. Your providers are listed under Providers declared for this tenant, each marked Serving sign-in or Not serving sign-in.
  3. To disable a provider:
    1. Select Disable on its row. This is offered only while it is serving sign-in.
    2. Under Why is this provider being disabled?, enter the reason.
    3. Confirm with Disable.
  4. To delete a provider:
    1. Select Delete on its row. The dialog Delete this identity provider lists what goes with it under Deleting it also:, and warns you when the provider is serving sign-in right now.
    2. To stop here and keep the configuration, select Disable it instead.
    3. Otherwise, under Why is this provider being deleted?, enter the reason.
    4. Confirm with Delete provider.

What you see when it worked

A disabled provider stays in the list as Not serving sign-in; nobody can sign in through it until it is enabled again. A deleted provider disappears from the list, and sign-in through it stops the moment you confirm. Both are recorded in the audit trail with your reason.

A member set to sign in Through the identity provider only cannot sign in to your tenant while the provider is disabled, nor after it is deleted, until an administrator sets them to As the tenant admits (Require a specific sign-in method for one user). After a deletion, anyone else whose account it unbound signs in with their own password, or sets one with Forgot password? on the sign-in page.

If your tenant's sign-in is set to Through the identity provider only, members still linked to a disabled provider cannot sign in until it is enabled again; the members you designated for break-glass access still enter with their security keys. Review Choose how members sign in before you withdraw the provider.

If it fails

What you see Cause What to do
Deleting this identity provider would leave <n> tenant(s) with no account able to sign in: … Every active account of the tenant signs in through this provider Create or activate a local administrator, then delete again
The reason is refused The reason is blank Enter the reason
You can see these providers, but disabling or deleting one needs permission to configure identity federation for this tenant. You can read the providers but not configure them Ask an administrator who holds that permission
Refused while impersonating On a SaaS deployment, a platform operator in a support-access session cannot delete the provider The tenant's own administrator deletes it

Without the console

Surface How
API POST /api/v3/admin/tenants/{tenantId}/idp/{id}/disable with {"reason": "..."} (operation disableIdp)
API POST /api/v3/admin/tenants/{tenantId}/idp/{id}/revoke with {"reason": "..."} (operation revokeIdp)

No ankasecure-km command and no Admin SDK method manage identity providers.