When an AzureAD user is deleted, the ServiceNow user does not become inactive.

[hamauzutr13]

We are linking AzureAD and ServiceNow instances with SCIM to perform user provisioning. When a user is deleted on the AzureAD side, the corresponding user remains active on the ServiceNow instance side and does not become inactive. In addition, when a user is deleted on the AzureAD side, some users have their user IDs changed to random strings on the ServiceNow side, while others do not. We would like to know what the specifications are for this. We are integrating Azure AD and ServiceNow instances using SCIM for user provisioning. When a user is deleted on the Azure AD side, the corresponding user remains active on the ServiceNow instance side and does not become inactive. Furthermore, when a user is deleted on the Azure AD side, some users have their user IDs changed to random strings on the ServiceNow side, while others do not. Could you please explain what this specification is?

[Nikhil Bajaj9]

Hi @hamauzutr13 ,

Not sure how this integration is working but in general users should never be deleted from AD side. 

Probable solution:- If you are using transform map then you can use any flag to mark that user deleted from AD and then use transform script to make user inactive in Servicenow, based on this falg.

if my answer helped you, please mark it- solution accepted.

 Regards,

Nikhil Bajaj

[Mark Manders]

You asked the same thing twice, without providing us any information on how you are integrating. Did you check flows/jobs/rules or whatever you are using for the integration? Did you check logs? What do the SCIM and AD logs say?

[Rafael Batistot]

Hi @hamauzutr13 

Thanks for explaining 

What happens when a user is deleted in 

Azure AD with SCIM → ServiceNow

1. User is not hard-deleted in ServiceNow.
   
• ServiceNow does not delete the sys_user record.
• Instead, the user stays in the table (for auditing, references, history).
• The account remains active = true unless the SCIM app is explicitly configured to set active=false.
• Out-of-the-box, SCIM does not deactivate users on delete; you must customize that behavior.
2. User ID (user_name) randomization.
   
• When Azure AD sends a Delete (deprovision) event via SCIM, ServiceNow renames the user_name to a random GUID-like string if that username is unique in the system.
• This is by design to avoid collisions if a new user with the same UPN is later provisioned again.
• Example: user_name becomes something like 2c92c0f0b39a4fadb16f7d85b7dcdabc.
• Sometimes you don’t see this happen because:
  
• The user_name was already unique and free for reuse.
• Or the SCIM configuration skipped the overwrite (depends on provisioning mode in Azure AD).
3. Why ServiceNow does this
   
• ServiceNow treats user_name as a unique key.
• If a user is deprovisioned but not deleted, ServiceNow scrambles the user_name to free up the original UPN for future users.
• That way, if the same person is later re-provisioned from Azure AD, SCIM can insert them cleanly without duplicate constraint errors

https://www.servicenow.com/docs/bundle/zurich-integrate-applications/page/administer/orchestration-a...

[Dr Atul G- LNG]

Hi @hamauzutr13 

As a BPC, I can say that using account deletion is never recommended in AD. Instead, set it to inactive (false) and pass it to ServiceNow through integration. The record in ServiceNow will then be inactive, but it should not be deleted — never delete it