Remove User From Groups

Remove a user from one or more Entra ID groups. The user_id value can be either an Entra object ID or a UPN.

By default, the valve runs once for every current item in the pipe context. Set execution_mode to "once" to remove the configured user from the configured groups only once for the whole flow.

Note

https://learn.microsoft.com/en-us/graph/api/group-delete-members

Introduction

Requires an EntraID module.

Configuration

Note

Valve name: EntraIDRemoveUserFromGroups

Properties

Name	Description	Default value	Mandatory	Expanded
namespace	Bind to EntraID module.	"default"
user_id	User object id or UPN. Non-GUID values are resolved to an object id before the group member delete operations are sent to Graph.
group_identifier	JsonArray with group objects.
execution_mode	Controls how the valve iterates. "per_item" runs once for each current item in the pipe context. "once" runs a single group membership operation for the whole flow, even if multiple items already exist.	"per_item"
use_beta_api	Graph API beta endpoint.	false

Example

{
  "name": "EntraIDRemoveUserFromGroups",
  "config": {
    "namespace": "entra01",
    "user_id": "${request.selected_entra_id}",
    "group_identifier": "@json:${request.entra_pending_add.all}",
    "execution_mode": "once"
  }
}

Use "execution_mode": "per_item" when user_id or group_identifier is based on ${item...} and you want one membership operation per input item.

Use "execution_mode": "once" when both values come from request data, globals, or another non-item source, and you want exactly one membership operation for the valve.

Example pipe data

  "selected_entra_id" : "e1e317a2-d76d-4ecd-8d6b-ab6c0a08f8c7",
  "entra_pending_add" : [ {
    "id" : "fb42d4ae-c1c8-4420-b37c-79aa011bfca0",
    "displayName" : "Salesforce"
  }, {
    "id" : "727c22dd-f8d3-4a6d-ba70-c7c2b24ab5ce",
    "displayName" : "LoA 1"
  } ],