Skip to main content
R
rstaselbeta
Inspiring
August 21, 2025
Question

User Sync to Azure Sync, Users not being removed from Products

  • August 21, 2025
  • 1 reply
  • 830 views

We transitioned from the User Sync Tool to Azure Sync about a year ago, and during an audit realized the Azure Sync wasn't removing users from Product profiles because it didn't put them there (as part of the group). 

 

Group from Azure works great. It's auto-assigned to the Product Profile and that works great. But, it won't touch users that "it didn't put there" as part of the group. Far as it's concerned, we manually added them to the profile. 

 

How do you basically say "I don't want anyone else in this product BUT the Azure Group"? Just delete everyone from the product? Will it actually add them back via the sync'd group? I'm having a hard time finding this documented anywhere... Right now we have hundreds of users "over provisioned" because of this... 

1 reply

A
Community Manager
Anshul_NautiyalCommunity Manager
Community Manager
August 21, 2025

Hi @rstaselbeta,

 

Thanks for reaching out. Azure Sync manages only the users and groups included in its provisioning scope in Azure AD. It will create, update, or disable users coming from Azure-synced groups but won’t remove users who were already in Product Profiles before migrating from the User Sync Tool. These users are considered manually assigned and will stay licensed until explicitly removed.

 

To make the Product Profile group-only, perform a one-time cleanup by bulk-unassigning all users who are not part of the Azure-synced group. This can be done in the Admin Console via the UI or by using a CSV upload. For detailed steps, refer to: https://adobe.ly/4mYfIK6
After clearing the profile, Azure Sync will automatically repopulate it with only the members of the in-scope Azure group during the next sync cycle.

 

Hope this helps. Let us know if you need any additional assistance.

 

Regards,
^AN

    R
    rstaselbetaAuthor
    Inspiring
    August 21, 2025

    This is great, and exactly what I expected. I knew it wasn't doing anything because it didn't put the user in the product. I just wasn't sure if I nuked the product assignment if the sync would put people back. 

     

    I guess the questions are:

    -How long will it take for the sync to put them back? Are users going to potentially get notified that they've lost access to the product?

    -Do I need to enable editing or disable sync during that time, or will it let me remove the users from the product since it didn't put them there?
    -Previously when I've just tried to grab a CSV from the product page of assigned users, it's been incomplete (it didn't match the number on the actual product). Has that been fixed, or do I need to grab a full user CSV and just grab the users from it that are assigned to that specific product to do the removal?

    A
    Community Manager
    Anshul_NautiyalCommunity Manager
    Community Manager
    August 21, 2025

    Hi @rstaselbeta,

     

    Thanks for sharing the details. 

     

    Azure SCIM provisioning runs an initial sync followed by incremental syncs approximately every 40–60 minutes. Users removed from a Product Profile who are still in the synced Azure group will be added back in the next cycle; users outside the group will remain unassigned. Adobe does not specify “access lost” notifications for this, and users generally do not receive alerts when being removed or re-added to a Product Profile, though they may notice brief access interruptions if they attempt to use the product during that period.

    Do editing or sync need to be toggled to remove users from the Product Profile?

    No. You can bulk-unassign users from a Product Profile even while Azure Sync is active. The “Allow editing synced data” option applies to directory-level edits only and is not required for Product Profile membership cleanup. This can be done directly in the Admin Console using the UI or CSV.

    CSV export from the Product page was incomplete — which CSV should be used?

    Use the Product Profile’s bulk operation feature. From the specific Product Profile, download the current user list via CSV, then upload a CSV to unassign those users in bulk. After the upload, verify results in the profile’s Bulk Operations section. If any discrepancies are found, cross-check with an organization-wide user CSV to ensure formatting and identifiers align with Admin Console requirements. Refer to the “Remove users and user groups from a product profile” section in this document: https://adobe.ly/45MsqEG

     

    However, if you need assistance with the process, I recommend raising a support case so our team can guide you through it directly and help resolve this issue.

    Regards,
    ^AN

      Terms & ConditionsAccessibility statement
      Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices