> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://support.granitegrc.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# How do I remove users from the system?

**If you are using SSO/SCIM provisioning (e.g., AD/Azure AD):**
* Remove or passivate the user in your organization's identity provider (IdP). SCIM synchronization will automatically deactivate the account in Granite.
* A passivated user will no longer appear in Granite's end-user views (such as training completion reports or form assignee selections). However, the user profile and audit trail are retained for auditing purposes. This is intentional.
* If a user removed from AD does not disappear from Granite, the account may not originally have been managed through provisioning. In this case, either passivate the account manually in Granite (if applicable), or Contact Granite Customer Support and request the account's removal or deactivation.

**If you use local Granite accounts:**
* Locate the user you want to remove on the **Users** page in the **Admin** view.
* Remove the user's access roles and click **Passivate User.**
* The deactivated account remains in Granite to preserve audit log integrity, but the user will no longer appear in end-user views (such as training completion reports or form assignee selections).

**Permanent deletion (database-level removal):**
* Admins cannot permanently delete user accounts through the user interface. Our technical team can remove accounts for justified reasons (for example, clearly identified test accounts), but this is generally not recommended due to auditing requirements.
* Submit a support request by emailing support@granitegrc.com and include the user's identifier or account details, reason for removal and confirmation that all responsibilities have been reassigned and that the removal will not impact reporting. 

**Tips and troubleshooting**
* If a user continues to receive Granite email notifications, check whether multiple user accounts exist with the same email address.
* Before passivating an account, ensure that any forms, tasks, or responsibilities assigned to the user have been reassigned to appropriate replacement owners.
* Synchronization between the identity provider (IdP) and Granite occurs automatically if SCIM provisioning is in use, but it may take some time for changes to be reflected in the system.