User & Group Self-Service
Remove Owners
Take owners off the groups they no longer manage, with a request per group on the record.
Completes when the owners are taken off the group in Avatier and in the directory, once approved or applied.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Remove Owners from the AI Assistant You Already Use
The tenant's Remove Group Owner workflow decides who approves, with identity verification first in Avabot and MCP. One completed owner removal = one Secure Outcome; failed attempts are never billed.
You: Remove Chris Wong as an owner of the Sales Ops group. Justification: moved to another team. Avatier: verify: passed · group: Sales Ops · owners: 1 selected · request: submitted, may need approval
Why it matters
An Owner Who Moved On Should Not Still Manage the Group.
Owners manage a group's members, so taking an owner off deserves the same record as adding one.
What a removal needs
The groups, the owners to take off, an optional justification, and the approval your Remove Group Owner workflow sets.
What goes wrong by hand
Removing owners by email or ticket leaves no request per group, no approval record and no activity-log entry to show it happened.
What Remove Owners does
You pick from each group's current owners, and each group gets its own request. The primary owner stays until another owner is made primary.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any group loses an owner this month or not. Pay Per Identity Action™ charges only for completed owner removals.
The Action
How Remove Owners Runs
On the web, Remove Owners walks through these screens, for one or many groups at once. In Avabot and MCP you verify, name one group, pick from its owners, give an optional justification and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Remove Owners starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in.
Identity Verification (Avabot and MCP)
Pick the Groups
Open the Remove Owners tile and pick one or more groups. Remove in Modify Group > group > Owners opens the same request flow.
Pick the Owners
Choose Next to see the current owners of those groups, and tick the owners to remove, or use Select All. The primary owner cannot be ticked.
Give a Justification
Save opens the confirmation, where you enter a Justification. It is optional.
Confirm
Confirm. Each group gets its own request, recorded in Request History with a Request ID, and goes through the Remove Group Owner workflow. Group Self-Service admins are asked whether to use workflow and can apply the change at once.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, each request removes owners from one group, and Avabot refuses to remove the primary owner or to leave fewer than two owners. Group Self-Service admins and that group's owners can apply it now.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An owner removal completes when the owners are taken off Avatier's Group Self-Service record and the directory group's owner list, once the request is approved, or at once when a Group Self-Service admin applies it. One completed owner removal = one Secure Outcome.
Evidence
- A Request ID for each group in Request History (filter Remove Group Owner, exportable)
- An activity-log entry
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Owner Removal
Pay per completed owner removal. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Remove Owners, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed owner removals only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved or applied, the owners are taken off each group in Avatier and in the directory, one request per group |
| Evidence | Silent failures and missing audit trails | A Request ID for each group in Request History and an activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Groups Remove Owners Touches
Remove Owners updates the owner list through the group's Group Self-Service connector: Active Directory, Microsoft Entra ID, AWS or Okta.
- AWS
- Okta
- Microsoft
- Active Directory and Microsoft Entra ID groups, through their Group Self-Service connectors.
- Other Systems
- AWS and Okta groups, through their Group Self-Service connectors.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can I remove the primary owner?
Not directly. Make another owner primary with Change Primary in Modify Group, then remove the former primary. Avabot refuses as well.
Can policy block an owner removal?
No. Group Self-Service policy stops additions only and never blocks a removal.
Does removing an owner need approval?
The Remove Owners flow follows your tenant's Remove Group Owner workflow. Group Self-Service admins can choose to skip it.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Remove Owners
You've Automated the System. Now Secure the Groups.
Pick the groups and the owners to take off, and each group's request is recorded in Request History with a Request ID.