Skip to content

Remove a user

Remove a person's membership from your tenant. They lose every role and link they held here and can no longer sign in to your tenant. Removing a pending invitation withdraws it.

Who can do it

A tenant administrator or a tenant access administrator, or a platform super administrator working inside your tenant. The request needs the permission to delete users. A support-access session can remove a person, so that an incident can be contained.

You can only remove someone whose permissions in your tenant you cover: a tenant access administrator cannot remove a tenant administrator. You cannot remove yourself.

Before you start

  • Have a reason ready. It is required and recorded in the audit trail.
  • If your tenant signs members in through its identity provider only, check that the person is not the last break-glass member that keeps the tenant reachable. That member cannot be removed until another is designated.

Steps

  1. Open Users in the sidebar.
  2. On the person's row, select the trash icon (Delete). It is not shown on your own row.
  3. In Delete User, type the person's email exactly as shown.
  4. Type the Reason.
  5. Select Revoke.

What you see when it worked

The console says User deleted and the person leaves Team Members. The membership is removed immediately, with its roles and links in your tenant, and the person's sessions here end. Their account and their memberships in other organizations remain. A removed PENDING membership's link stops working.

If it fails

The console shows Failed to delete user, with the reason:

Reason Cause What to do
A refusal naming the permissions you lack (scope-subset-violation) The person holds permissions in your tenant that you do not Ask an administrator who holds those permissions
A refusal of a self-deletion or of a system account You addressed your own account, or the tenant's protected system account Ask another administrator, or leave the system account in place
A conflict about the last break-glass designation The person is the last break-glass member of a tenant that signs in through its identity provider only Designate another member, or change the tenant's sign-in requirements, first
A refusal from an emergency-access session You signed in through break-glass and the person holds a break-glass designation Sign in normally to remove them

Without the console

Surface How
API POST /api/v3/admin/tenants/{tenantId}/users/{userId}/revoke (operation revokeHumanUser) with the reason

The key management CLI and the admin SDK have no command or method for this task.