All Products
Search

This Product

    Identity as a Service:What to do if IDaaS fails to delete synchronized RAM accounts?

    Document Center

    Identity as a Service:What to do if IDaaS fails to delete synchronized RAM accounts?

    Last Updated:May 26, 2025

    Problem

    When deleting a user with account synchronization enabled in the Enterprise Identity Access Management (EIAM) system of Alibaba Cloud IDaaS, the corresponding RAM user is not deleted synchronously.

    Possible causes

    1. The RAM account is in a special state (such as bound to a multi-factor authentication (MFA) device, has configured AccessKeys, or is part of a user group).

    2. Incorrect synchronization scope settings. The organization of the deleted user may not match the synchronization scope settings.

    3. Parameter configuration errors cause synchronization request exceptions.

    Usage notes

    1. Back up important information first: Ensure there are no critical resources or permissions associated with the RAM account before deletion.

    2. Assess impacts: Deleting a RAM account will forcibly log out that account and its assumed roles without automatic recovery.

    3. Manage permissions: Ensure the administrator has sufficient permissions, such as AliyunRAMFullAccess.

    Solution

    As IDaaS cannot automatically synchronize the deletion of RAM accounts in special states, follow these steps manually:

    Step 1: Remove the special state of the RAM account

    1. Remove from user groups:

      1. Log on to the Alibaba Cloud RAM console.

      2. In the left navigation bar, select Identities > Users.

      3. Find the target RAM account and click its name to go to the details page.

      4. In the user group area, remove the account from all user groups.

    2. Detach MFA device (if any):

      1. In the RAM console, go to the details page of the target RAM account.

      2. In the Identities > Users > Authentication > Security Information Management area, detach the MFA device.

    3. Delete AccessKey (if any):

      1. On the details page of the target RAM account, go to the AccessKey management area.

      2. Delete all configured AccessKeys.

    Step 2: Delete the RAM account

    1. Log on to the RAM console.

    2. In the left navigation bar, select Identities > Users.

    3. Find the target RAM account and click Delete in the Actions column.

    4. Follow the prompts to complete the deletion.