Overview
When a user is deactivated in an identity provider, Pharos Cloud can mark the user as inactive rather than fully deleting the user record. With Okta, for example, when the user is later reactivated, Pharos Cloud can mark the user as active again. Card registration behavior can vary depending on how the card value was created and stored.
Applies to
- Pharos Cloud
- SCIM user and group synchronization
- Identity provider integrations such as Okta
Symptoms
- A user is deactivated in an identity provider and still remains in Pharos Cloud.
- The user becomes inactive rather than being fully deleted.
- The card value is no longer visible while the user is inactive.
- With Okta, for example, after the user is reactivated, the card value returns.
- A manually added card value may be shown as `*******` after reactivation instead of the original visible value.
Cause
SCIM synchronization updates user status in Pharos Cloud based on the identity provider lifecycle state, but it does not necessarily hard delete the user record or permanently remove associated registration data. With Okta, for example, reactivation can restore the user to an active state, and manually added card data may display as a masked or hashed value after reactivation.
Resolution
- Confirm that the identity provider provisioning settings are configured with the expected lifecycle options enabled.
- Deactivate the user in the identity provider and allow the SCIM synchronization to complete.
- In Pharos Cloud, verify that the user is marked inactive.
- If needed, reactivate the user in the identity provider and allow synchronization to complete again.
- Verify that the user returns to an active state in Pharos Cloud.
- Check the card registration value after reactivation.
- If the card value returns as expected, no further action may be needed.
- With Okta, for example, a manually added card value may be shown as `*******`, which should be treated as masked or hashed stored data rather than assuming the registration was removed.
- If you must fully remove the user and associated Pharos data, use the User Removal API or remove the user manually in Pharos Cloud.
- If you must remove badge, PIN, card, or mobile registration data for reuse or cleanup, use the User Registration Removal API or remove the registration manually.
Notes
- Deactivation in an identity provider results in an inactive user state in Pharos Cloud, not necessarily a hard deletion.
- With Okta, for example, reactivation can restore the user to active status in Pharos Cloud.
- Card visibility after reactivation may differ for manually added card values because the stored value can appear masked.
- If you need deterministic cleanup of user registrations, use the dedicated API or manual removal workflow rather than relying only on SCIM lifecycle changes.