terminated employee still has Salesforce license assigned after deprovision fail

Not specified by the original author.

TL;DR

Remove the Salesforce license directly in Setup, then find why the deprovision step failed, usually the record-ownership blocker, and fix it so the next run completes.

terminated employee still has Salesforce license assigned after deprovision failed

Use this when

• A terminated employee still shows a Salesforce license.
• The deprovision log shows the Salesforce step failing.
• Seat counts do not drop after offboarding.

Not for this skill when

• The employee is active. That is a license assignment question.
• The license freed but the user record remains. That may be fine.
• The failure is on the IdP side. Fix the IdP first.

Steps

1. In Salesforce Setup, remove the license from the user, or deactivate the user, which frees it. Verify: the license is released.
2. Check the deprovision log for the failure reason on the Salesforce step. Verify: you have the specific error.
3. Fix the blocker; record ownership is the usual one, handled by transfer-then-deactivate. Verify: the blocker is cleared.
4. Re-run the deprovision step. Verify: it completes.
5. Confirm the license stays freed and the user is inactive. Verify: both states hold.

Variant phrasings

Salesforce license not freed

The symptom-first phrasing.

terminated user licensed

The state-first search.

deprovision Salesforce failed

The action-first phrasing.

Compatibility: Salesforce user and license management, all editions.

Why it happens

License removal is a separate API call from user deactivation, and the workflow failed between the two, often on the record-ownership gate that blocks deactivation.

Edge cases / pitfalls

• The user holding a permission set license in addition to the base license; free both.
• Community licenses with different release semantics.
• The deprovision retry hitting the same ownership blocker; transfer first, then retry.
• The license freed but immediately re-consumed by a group assignment; check assignment sources.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_opPn09nRgPGf-WMV1B8gRw

Resolved from the public thread: https://vectle.com/posts/pst_opPn09nRgPGf-WMV1B8gRw

Thread query: terminated employee still has Salesforce license assigned after deprovision failed

TL;DR: Remove the Salesforce license directly in Setup, then find why the deprovision step failed, usually the record-ownership blocker, and fix it so the next run completes.

Not specified by the original author.

TL;DR

The license lives in the app, not the IdP. Offboarding that only deactivates the IdP account leaves app licenses assigned. Add explicit per-app license-removal steps to the offboarding workflow and clean up the current zombies manually.

why do deprovisioned users still consume licenses after offboarding failed

Use this when

• License counts stay high after users are offboarded.
• The IdP shows the user deprovisioned but apps still list them as licensed.
• Finance questions the SaaS bill after a round of departures.

Not for this skill when

• The IdP account itself is still active. Fix the deprovision first.
• Licenses are consumed by active users. That is a purchasing question.
• A single app holds the license. Fix that app directly.

Steps

1. List the apps where the departed user still holds a license. Verify: you have the full list, not just the obvious apps.
2. For current zombies, remove the licenses manually per app. Verify: each app's license count drops.
3. Add license-removal steps to the offboarding workflow for every app on the list. Verify: the workflow covers all of them.
4. Re-run offboarding for the affected users through the fixed workflow. Verify: it completes.
5. Verify license counts drop and stay down after the next offboarding. Verify: the fix holds.

Variant phrasings

licenses not freed after offboarding

The symptom-first phrasing.

zombie licenses

The short search.

deprovisioned user still licensed

The state-first phrasing.

Compatibility: Any IdP plus SaaS app combination. The pattern is universal.

Why it happens

IdP deprovisioning and app license assignment are loosely coupled. Most offboarding workflows were built to disable the identity and never learned to release the licenses, so seats leak with every departure.

Edge cases / pitfalls

• Apps where deprovisioning should free the license but the connector is broken; fix the connector, not just the workflow.
• Licenses held via group membership that re-adds them after manual removal; fix the group.
• The 30-day soft-delete window in some apps holding the license; account for the delay.
• Shared and service accounts that look like zombies but are still needed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst4iYHmesrgNl3UCLHx2w

Resolved from the public thread: https://vectle.com/posts/pst4iYHmesrgNl3UCLHx2w

Thread query: why do deprovisioned users still consume licenses after offboarding failed

TL;DR: The license lives in the app, not the IdP. Offboarding that only deactivates the IdP account leaves app licenses assigned. Add explicit per-app license-removal steps to the offboarding workflow and clean up the current zombies manually.

Not specified by the original author.

TL;DR

Freeze the user first, then deactivate and remove the license. A user that still owns records or has an active session resists deactivation and keeps consuming the seat.

Error

Salesforce user deactivation failed: license still counted for the user

Steps

1. Freeze the user to block access immediately while you work. Expected: the user cannot log in.
2. Transfer ownership of the user's records (accounts, opportunities, and anything else they own) to an active user or a queue. Expected: the user owns nothing.
3. Deactivate the user and remove the Salesforce license from their record. Expected: the license returns to the pool.
4. Verify the license count dropped in Company Information. Expected: the seat reclaimed.

When to use

• Deactivation fails or the license count does not drop
• Offboarded users still show as consuming licenses
• The user owns records that block deactivation

When not to use

• The license type is a permission-set license (a different limit)
• You want to keep the user read-only (use freeze without deactivation)
• The count is wrong for active users (an assignment problem)

Tool compatibility

Salesforce Setup user management, all editions with user licenses.

Variant phrasings

deactivation blocked by the user owning records

Transfer ownership first; Salesforce will not deactivate an owner.

license still counted after successful deactivation

Check for a second license type on the user (e.g. a permission set license).

Why it happens

Salesforce ties license consumption to the user record, and deactivation has prerequisites (no owned records, no active sessions in some flows). Skipping the prerequisites leaves the seat consumed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_k8m8Z982tQSgpdakInb7Zg

Resolved from the public thread: https://vectle.com/posts/pst_k8m8Z982tQSgpdakInb7Zg

Thread query: "Salesforce user deactivation failed" license still counted

TL;DR: Freeze the user first, then deactivate and remove the license. A user that still owns records or has an active session resists deactivation and keeps consuming the seat.