Lifecycle & Access Governance
Remove Roles
Remove the roles that no longer fit, each as its own request with a justification on the record.
Completes when each role you picked is removed: at the scheduled time once approved, or at once when a workflow admin skips workflow.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Remove Roles from the AI Assistant You Already Use
Your Lifecycle Management approval workflow decides who approves, with identity verification first in Avabot and MCP. One completed role removal = one Secure Outcome; failed attempts are never billed.
You: Remove the Sales Manager role from Priya Shah. Reason: moved to Marketing. Avatier: verify: passed · role: Sales Manager · reason: moved to Marketing · request: submitted, may need approval
Why it matters
A Role That No Longer Fits Should Not Stay Assigned.
When someone's job changes, the roles they held stay assigned until someone removes them.
What a removal needs
The roles that no longer fit, picked from the person's assigned roles, a time, and a justification.
What goes wrong by hand
Removing roles by email or ticket leaves no request per role, no approval record and no activity-log entry.
What Remove Roles does
Each role you pick becomes its own removal request, routed for approval when the role's removal workflow is on, and run at the date you choose on the web.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any role is removed this month or not. Pay Per Identity Action™ charges only for completed role removals.
The Action
How Remove Roles Runs
On the web, Remove Roles walks through these screens. In Avabot and MCP you verify, name the user, pick one role from a numbered list, give a reason and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Remove Roles starts with identity verification in the conversation, with the methods your policy already allows, such as Security Questions, Google Authenticator, PingID push or Identity Challenge Card. On the web there is no extra check beyond your sign-in. A verification earlier in the same conversation carries over.
Identity Verification (Avabot and MCP)
Select the User
Pick the user: yourself, or someone your Lifecycle Management authority lets you request for. Workflow admins are then asked "Would you like to use workflow?"
Set the Time and Reason
On the workflow path, choose Remove Roles Now or a scheduled date and time, and enter a Justification.
Pick the Roles
On the Remove Roles list, in icon, list or detail view, search and tick the roles to remove, or use Select all. Roles already pending are flagged.
Remove
Tap Remove. "Success" appears and a notification follows. Each role becomes its own removal request, recorded in Request History with a Request ID, and goes to approval when the role's removal workflow is on. A workflow admin who skips workflow removes it at once, with no approver recorded.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, each request removes one role, effective now, and always goes through workflow.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A role removal completes when each role you picked is removed: at the scheduled time once approved, or at once when a workflow admin skips workflow. Each role is its own request, with a Request ID and an activity-log entry. One completed role removal = one Secure Outcome.
Evidence
- A Request ID for each role in Request History (exportable)
- An activity-log entry for each removal
- The "Remove roles request successfully submitted" notification
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Role Removal
Pay per completed role removal. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Remove Roles, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed role removals only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Each role is removed at the time you set once approved, as its own request |
| Evidence | Silent failures and missing audit trails | A Request ID and an activity-log entry for every role removed |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Remove Roles Touches
Remove Roles reaches the systems that the role's privileges are provisioned to through connectors, such as Active Directory or Entra ID groups, LDAP or application entitlements.
- LDAP
- Microsoft
- Active Directory and Entra ID groups, through their connectors.
- Other Systems
- LDAP and application entitlements, through their connectors.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can I schedule a role removal for a future date?
Yes. On the web, choose a date and time on the workflow path and the removal takes effect then. Avabot removes immediately.
Who approves removing a role?
A removal follows the role's removal workflow, which is on by default, and your tenant's approval settings. Admins can turn removal approval off per role, or remove directly as a workflow admin.
Why does Avabot say the role is already being removed?
A removal for that role assignment is already in progress, so a second one isn't filed until it finishes.
Can I remove roles for many users at once?
No. On the web you can select several roles for one user; Avabot removes one role at a time.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Remove Roles
You've Automated the System. Now Secure the Lifecycle.
Pick the roles that no longer fit, give a reason, and each removal is recorded in Request History with a Request ID.