How User Deprovisioning and Restoration Works with Entra ID
Deprovisioning is the process by which changes you make to a user’s Entra ID account result in their removal from Newforma Konekt.
You can deprovision a user in several ways, both from your Microsoft tenant and directly in your Newforma Konekt hub. Each trigger follows the same core pattern: the user is disabled first, given a 30-day grace period, and only permanently deprovisioned if that period passes without the action being reversed.
Key Terms: Disabled, Deprovisioned, and Deactivated
Three different states can apply to a user during deprovisioning, and they are not interchangeable:
- Disabled: The user’s access to Newforma Konekt is blocked, but nothing is deleted. They can’t log in to the affected hub(s), but their project and task assignments and user information are preserved for the 30-day grace period. This is always the first state a user enters when you deprovision them, regardless of the trigger. This state can be completely reversed within 30 days.
- Deprovisioned: If the 30-day grace period passes without the triggering action being reversed, the user is removed from the hub(s). Their license, project and task assignments are released, but their user information is retained and their name still appears in the history of any task where they previously took action.
- Deactivated: A separate outcome that applies only when a user is hard-deleted in Entra ID. After the 30-day grace period, all of the user’s information in Newforma Konekt is deleted except their email address, which is kept in project history. A deactivated user can’t log in any hub and doesn’t consume a license.
How Disabled Users Appear in Newforma Konekt
Newforma Konekt appends “(Disabled)” to a disabled user’s last name throughout the application.
However, the disabled status is not shown in:
- History tabs and the notification center: History tabs and the notification center reflect a user’s status at the time an action was taken, not their current status. A user who was active at the time of making the action doesn’t appear as disabled.
- Teams and Outlook activity records: Teams and Outlook records capture activity from an external source rather than an action taken in Newforma Konekt, so disabled status doesn’t apply.
- RFI and submittal Details tabs record a snapshot of the user’s status at the time the action was taken, rather than their current status. A user only appears as disabled in the Details tab if they were already disabled at the time the RFI or submittal was sent or forwarded to them.
Deprovisioning Actions and Their Outcomes in Newforma Konekt
Triggered in Entra ID
| Action in Entra ID | Outcome in Newforma Konekt |
|---|---|
| You remove a user from a connected Entra group. | The user is disabled in hubs connected to that group, unless they belong to another connected group in those hubs that keeps them active. If not restored within 30 days, they are deprovisioned from the hubs. |
| You remove a nested Entra group from a connected parent Entra group. | Users in the nested group are disabled in hubs connected to the parent group, unless they belong to another connected group in those hubs. If not restored within 30 days, they are deprovisioned from the hubs. |
| You disable a user directly in Entra ID. | The user is disabled for the next 30 days and blocked from logging into any hub. If not restored within 30 days, they are deprovisioned from all hubs. |
| You delete a user in Entra ID. The user is first soft-deleted in Entra ID; they retain membership of the Entra ID groups they’re part of for 30 days, during which this action can be reversed. After 30 days, the user is hard-deleted and their account is deleted from Entra ID. | The user is disabled for the next 30 days and blocked from logging into any hub. After 30 days, the user is deactivated in Newforma Konekt. They are removed from all hubs, their assignments and licenses become unassigned, and only their email address is retained. |
| You delete a group in Entra ID. The group is first soft-deleted in Entra ID; all users retain group membership for 30 days, during which this action can be reversed. After 30 days, the group is hard-deleted and all users lose their Entra ID accounts unless they remain members of other groups | Users in the group are disabled across all hubs connected to that group, unless they belong to another group connected to those hubs. After 30 days, the users are deprovisioned (not deactivated) from the hubs. |
Triggered in Newforma Konekt
| Action in Newforma Konekt | Outcome in Newforma Konekt |
|---|---|
| You remove a connected Entra group from the hub. | Users in the group are disabled in that hub, unless they belong to another connected group. If not restored within 30 days, they are deprovisioned from that hub. |
| You disconnect the Microsoft tenant (technically not a deprovisioning action). | Disconnecting the tenant does not deprovision users. Previously synced users and their assignments remain unaffected, and the users are no longer managed by the Entra ID integration. |
You can’t delete Entra ID users from the User management page in Newforma Konekt. You must manage their access to Newforma Konekt via your Entra ID groups.
Hub Owner Exception
Hub Owners aren’t automatically deprovisioned from a hub after the 30-day grace period. You must manually reassign the Hub Owner role to another user before the account can be removed.
When you disable a hub owner, you will receive an email prompting you to contact Newforma Customer Support to reassign the role. Once the role is reassigned, the former hub owner is automatically deprovisioned after the 30-day grace period.
Restoring a User
Restoring a user in Entra ID during or after the 30-day grace period has different outcomes:
- During the grace period: Re-adding the user to any Entra ID group connected to the hub, or otherwise restoring or re-enabling them in Entra ID, automatically restores their Newforma Konekt account and hub access.
- After the grace period: The user’s account is re-added to hubs where their Entra ID group is connected, but their project and task assignments are not restored.
Notifications
You will be notified of user disablements through a dedicated disable report. This report is sent at the end of each day and groups all disabled users from the previous 24hr period. It includes a list of all open tasks assigned to the disabled users.