All Products
Search

This Product

    Identity as a Service:IDaas 同步删除RAM用户失败

    Document Center

    Identity as a Service:IDaas 同步删除RAM用户失败

    Last Updated:Apr 11, 2026

    Symptoms

    After you delete a user in Alibaba Cloud IDaaS (Enterprise Identity Access Management) with account synchronization enabled, the corresponding RAM user is not deleted.

    Possible causes

    1. The RAM user is in a special state, for example, it has a bound MFA device, a configured AccessKey, or is a member of a user group.

    2. If the deleted user's organization is outside the defined synchronization scope, IDaaS does not trigger the deletion.

    3. An invalid parameter configuration causes the synchronization request to fail.

    Precautions

    1. Check for critical associations: Before you delete a RAM user, ensure that no critical resources or permission configurations are associated with the user.

    2. Assess the impact: After a RAM user is deleted, the user and its assumed roles are forcibly signed out and cannot be recovered.

    3. Permission management: Ensure the administrator performing these operations has sufficient permissions, such as the AliyunRAMFullAccess policy.

    Solution

    IDaaS cannot automatically synchronize the deletion of RAM users that are in a special state. You must perform the following steps manually.

    Step 1: Clear the special state

    1. Remove the user from user groups:

      1. Sign in to the Alibaba Cloud RAM console.

      2. In the left-side navigation pane, choose Identities > Users.

      3. Find the target RAM user and click the username to view its details page.

      4. In the user groups section, remove the user from all user groups.

    2. Unbind the MFA device (if applicable):

      1. In the RAM console, go to the details page of the target RAM user.

      2. On the Identities > Users > Authentication tab, unbind the MFA device in the Security Information Management section. For more information, see Unbind an MFA device for a RAM user.

    3. Delete AccessKeys (if any):

      1. Go to the AccessKey management section.

      2. Delete all configured AccessKeys.

    Step 2: Manually delete the RAM user

    1. Sign in to the Alibaba Cloud RAM console.

    2. In the left-side navigation pane, choose Identities > Users.

    3. Find the target RAM user and in the Actions column, click Delete.

    4. Follow the on-screen instructions to complete the deletion.