Description:

This step removes a user from one or more Microsoft Entra ID groups.

The Remove User From EntraID Groups workflow step connects to Microsoft Entra ID (formerly Azure Active Directory) and removes a single existing user from one or more specified security or Microsoft 365 groups.

The step accepts a row-delimited list of group names, allowing multiple group memberships to be removed in a single workflow step.

The step supports:

• Microsoft Entra ID group membership management
• Removing a user from multiple groups in a single operation
• Configurable Entra ID connections
• Dynamic group lists using workflow variables
• Integration with Microsoft Graph through FlowWright connections

This step can be used for:

• Employee offboarding
• Department transfers
• Project completion
• Temporary access removal
• Security group cleanup
• Identity lifecycle management
• Business process automation

Usage:

The Remove User From EntraID Groups step is typically placed after employee information has been updated or approved within a workflow.

The workflow can dynamically populate the username and group list using workflow variables, form fields, HR systems, or data retrieved from external applications.

Once the user has been removed from the specified groups, later workflow steps can:

• Add the user to the new groups
• Assign new application roles
• Update security permissions
• Notify administrators
• Synchronize downstream systems
• Continue employee lifecycle workflows

You need to set up an EntraID connection. Go to Integration > Connections > Generic Connections. On the Manage Generic Connections page, click Actions > Create. A sample connection is included here for reference. 

Example:

Let’s build and execute the “clsRemoveUserFromEntraIDGroupsDef” example:

• Create a new process definition named “clsRemoveUserFromEntraIDGroupsDef” and open it in designer mode. 
• Drag a “clsRemoveUserFromEntraIDGroups” step to the canvas.
• Connect the dots between the “Start” and “clsRemoveUserFromEntraIDGroups” steps.
• Click the "clsRemoveUserFromEntraIDGroups" step to configure its "Required" properties. Provide a name for the step. Select the EntraID connection from the drop-down list. Provide the “Username”. Click the button to add “Group Names”. Click the Save button. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• Click the button to add “Group Names”. A pop-up is rendered for configuration. Click the Add Row (+) button to insert an empty row. Provide the “Group Name”. Click the Save button. You may insert multiple group names by using the Add Row button.  

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Remove User From Groups step, FlowWright connects to the configured Microsoft Entra ID tenant and removes the specified user from each configured group. If the user is successfully removed from all specified groups, the workflow follows the True return path. If one or more groups cannot be processed—for example, because a group does not exist, the user is not a member of a group, or the connection is unavailable—the workflow follows the False return path.

Tips:

• Verify that the Microsoft Entra ID connection has been configured before using this step.
• Use workflow variables to dynamically populate usernames and group names.
• Enter one group name per line.
• Verify that each specified group exists before executing the workflow.
• Ensure that the user is currently a member of the specified groups before attempting to remove membership.
• Use the True and False return paths to implement appropriate success and error handling.
• Combine this step with Add User To Groups or role assignment steps when automating department transfers or access reviews.

Notes:

• A valid Microsoft Entra ID connection must exist before this step can execute.
• The configured connection must have sufficient Microsoft Graph permissions to manage group memberships.
• The specified user account and groups must already exist in Microsoft Entra ID.
• Invalid usernames or group names may cause the operation to fail.
• Network connectivity or authentication issues may prevent successful removal.
• The workflow should include appropriate error handling for the False return path.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• Microsoft Entra ID connection
• Username mapping
• Group name mappings
• Workflow variable mappings
• Microsoft Graph permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.