# SCIM directory sync: A deep dive into deprovisioning

DevFeed: [SCIM directory sync: A deep dive into deprovisioning](<https://devfeed.tech/articles/scim-directory-sync-a-deep-dive-into-deprovisioning-16057.md>)

Original publisher: [Read original article](<https://workos.com/blog/scim-directory-sync-deprovisioning-deep-dive>)

Author: WorkOS

Published: 2026-09-08T00:00:00Z

Content type: article

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [Security](<https://devfeed.tech/topics/security.md>), [Parser](<https://devfeed.tech/topics/parser.md>), [Entra ID](<https://devfeed.tech/topics/entra-id.md>)

Tags: [audit](<https://devfeed.tech/tags/audit.md>), [deep-dive](<https://devfeed.tech/tags/deep-dive.md>), [filter](<https://devfeed.tech/tags/filter.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [provisioning](<https://devfeed.tech/tags/provisioning.md>), [reconciliation](<https://devfeed.tech/tags/reconciliation.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This deep dive explains how SCIM directory deprovisioning reaches applications, why identity providers commonly deactivate users instead of deleting them, and how provider-specific payloads and missed events can create security risks. It covers normalization, reconciliation, session termination, and inspecting provider requests.

## Source excerpt

What actually happens when a user is removed: the event your app receives, the directories that never send one, and how to catch what gets dropped.