Lifecycle & Access Governance
Delete Account
Permanently delete a person's accounts on the systems you pick, with separate disable and delete dates and a justification on the record.
Completes when the selected accounts are disabled and then deleted at the scheduled times, once the request is approved.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Delete Account from the AI Assistant You Already Use
The approval workflow set up for each system decides who approves, with identity verification first in Avabot and MCP, where every deletion is filed as an approval request. One completed account deletion = one Secure Outcome; failed attempts are never billed.
You: Delete Morgan Lee's accounts. Reason: Termination. Justification: left the company last quarter. Avatier: verify: passed · reason: Termination · systems: picked from list · request: submitted for approval
Why it matters
Accounts Nobody Uses Should Not Live Forever.
Once a person has left for good, their accounts should go too, through a request someone approved.
What a deletion needs
The person's accounts on the systems to delete, a reason, when to disable and when to delete, and a justification, routed through each system's approval workflow.
What goes wrong by hand
Deleting accounts by hand can't be undone, and leaves no request, no approval and no record of which systems were deleted and when.
What Delete Account does
It disables first and deletes on the date you set, never before the disable. Systems flagged "never delete" are skipped, and a system set to "disable on delete" is only disabled.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any account is deleted this month or not. Pay Per Identity Action™ charges only for completed account deletions.
The Action
How Delete Account Runs
On the web, Delete Account walks through these screens. In Avabot and MCP you verify, name the person, pick systems, give a reason and a justification, and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Delete Account starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in. Delete Account is high-risk, so by default it starts only if you verified in the last 5 minutes; otherwise you verify again.
Identity Verification (Avabot and MCP)
Select the User
Pick the system and search for the person: someone you are authorized to request for. You can't delete your own account. Workflow admins are then asked "Would you like to use workflow?"
Set the Reason and Dates
Pick a reason, choose when to disable (Disable Now or a date) and when to delete (Delete Now or a date), and enter a Justification. The delete can't come before the disable.
Confirm the Warning
Confirm the permanent-deletion warning. If you have Account Terminator rights and the person owns groups that would drop below the minimum number of owners, those groups are listed instead.
Pick the Systems
Pick the systems to delete. Systems flagged "never delete" are not offered.
Continue
Choose Continue to submit. The request is recorded in Request History with a Request ID and goes through the Lifecycle Management approval workflow for each selected system. A workflow admin with Account Terminator rights who skips workflow picks the reason and Delete Now or a delete date: the account is disabled at once and deleted at that time, with no request.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Delete Account always files an approval request, with the disable and the delete both set to run as soon as it is approved: there is no scheduling and no way to skip approval.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An account deletion completes when the approved request runs: the selected accounts are disabled and then deleted at the scheduled times. A system set to "disable on delete" is only disabled, and a connector's disable grace period can delay the disable step. A workflow admin who skips workflow disables the account at once and deletes it immediately or at the chosen time, with no request and a result for each system. One completed account deletion = one Secure Outcome.
Evidence
- A Request ID in Request History (filter Delete Account, PDF or Excel export)
- An activity-log entry
- Audit reports such as Account Terminator accounts deleted
- A result for each system, when a workflow admin skips workflow
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Account Deletion
Pay per completed account deletion. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Delete Account, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed account deletions only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved, the selected accounts are disabled and then deleted at the times you set |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History, an activity-log entry and audit reports |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Delete Account Touches
Delete Account removes the person's accounts from the connected systems you select, such as Active Directory, Entra ID, LDAP, Okta and other connector-managed applications. Systems flagged "never delete" are not offered and are skipped, and a system set to "disable on delete" is only disabled.
- LDAP
- Okta
- Microsoft
- Active Directory and Entra ID accounts, through their connectors.
- Other Systems
- LDAP, Okta and other connector-managed applications. A connector's disable grace period can delay the disable step.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can a deleted account be restored?
No. Deletion is permanent, except on systems set to only disable on delete, and the web app warns before you continue. Use Disable Account if the person might return.
What happens if the person owns groups?
For people with Account Terminator rights, the web app lists the groups that would drop below the required number of owners before you continue. Others see only the standard deletion warning.
Can I disable the account now and delete it later?
Yes. The web screen has separate disable and delete schedules, and the delete must come on or after the disable.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Delete Account
You've Automated the System. Now Secure the Lifecycle.
Pick the systems, set when to disable and when to delete, and each deletion request is recorded in Request History with a Request ID.