All Products
Search

This Product

    Identity as a Service:IDaaS fails to synchronize the deletion of a RAM user

    Document Center

    Identity as a Service:IDaaS fails to synchronize the deletion of a RAM user

    Last Updated:Oct 22, 2026

    Symptom

    You deleted a user in Alibaba Cloud IDaaS (EIAM) with account synchronization enabled, but the corresponding RAM user was not deleted through synchronization.

    Possible causes

    1. The RAM user is in a special state, such as having an MFA device bound, an AccessKey configured, or membership in a user group.

    2. The synchronization scope is incorrectly configured. Check whether the organization of the deleted user is the same as the organization in the configured synchronization scope. If the organizations are different, the synchronized deletion is not triggered.

    3. Incorrect parameter settings cause the synchronization request to fail.

    Precautions

    1. Back up important information: Before you delete a RAM user, make sure that no important resources or permission configurations are associated with it.

    2. Impact assessment: After a RAM user is deleted, the user and the roles that it assumes are forcibly signed out and cannot be automatically restored.

    3. Permission management: Make sure that the administrator who performs the preceding operations has sufficient permissions, such as AliyunRAMFullAccess.

    Solution

    IDaaS cannot automatically synchronize the deletion of a RAM user that is in a special state. Perform the following manual operations:

    Step 1: Remove the special state of the RAM user

    1. Remove the user from user groups:

      1. Log on to the Alibaba Cloud RAM console.

      2. In the left-side navigation pane, choose Identities > User.

      3. Find the target RAM user and click its name to go to the details page.

      4. In the user group section, remove the RAM user from all user groups.

    2. Unbind the MFA device (if any):

      1. In the RAM console, go to the details page of the target RAM user.

      2. Under Identities > User > Authentication, in the Security Information Management section, unbind the MFA device. For details, see Unbind an MFA device for a RAM user.

    3. Delete AccessKeys (if any):

      1. On the details page of the target RAM user, go to the AccessKey management section.

      2. Delete all configured AccessKeys.

    Step 2: Manually delete the RAM user

    1. Log on to the RAM console.

    2. In the left-side navigation pane, choose Identities > User.

    3. Find the target RAM user and click Remove in the Actions column.

    4. Follow the on-screen instructions to complete the deletion.