Hey dpavanbo!
1. In the account console, go to Security > User provisioning. If you see “Automatic identity management,” that’s expected on Azure; it replaces traditional SCIM UI and handles JIT on first sign‑in.
2. Automatic identity management: Ensure the user is active in Entra and have them sign in once to trigger JIT. For Entra SCIM app: Assign the user (or group) to the Databricks SCIM app, turn Provisioning On, restart sync, verify the SCIM token, and ensure userName maps to userPrincipalName (avoid UPN vs mail mismatch).
3. Remove/deactivate the user in Entra ID or unassign them from the Databricks/SCIM app; Databricks reflects the change on sync. Local delete is limited when IdP‑managed.
Hope this helps,
Sarah