User & Group Self-Service
Delete Group
Delete the groups you no longer need, shown on screen as Delete Groups, with a request per group on the record.
Completes when the group is deleted from the directory and removed from Group Self-Service management, once approved or applied.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Delete Group from the AI Assistant You Already Use
The tenant's Delete Group workflow decides who approves, as on the web, with identity verification first in Avabot and MCP. One completed group deletion = one Secure Outcome; failed attempts are never billed.
You: Delete the Project Atlas Archive group. Justification: project records moved. Avatier: verify: passed · group: Project Atlas Archive · request: submitted, may need approval
Why it matters
A Group Nobody Needs Should Not Keep Granting Access.
Old groups keep their members and permissions until someone deletes them, and a deletion cannot be undone.
What a deletion needs
The groups to delete, an acknowledgement that it can't be undone, an optional justification, and the approval your Delete Group workflow sets.
What goes wrong by hand
Deleting groups by hand or by ticket leaves no request per group, no approval record and no activity-log entry to show it happened.
What Delete Group does
Each group gets its own request. Once it runs, the group is deleted from the directory and removed from Group Self-Service management.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any group is deleted this month or not. Pay Per Identity Action™ charges only for completed group deletions.
The Action
How Delete Group Runs
On the web, the Delete Group tile opens the Delete Groups screens below, for one or many groups at once. In Avabot and MCP you verify, name one or more groups, give an optional justification and confirm explicitly.
Verify in Avabot or MCP
Avabot and MCP only. Delete Group starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in. Delete is a high-risk task, so by default it starts only if you verified in the last 5 minutes; otherwise Avabot asks you to verify again.
Identity Verification (Avabot and MCP)
Pick the Groups
Open the Delete Group tile and pick one or more groups on the Delete Groups screen. It is also under Modify Group > group > Actions > Delete Group.
Accept the Warning
Accept the warning that the action can't be undone, then enter a Justification in the dialog. It is optional.
Confirm
Confirm, and a success message appears. Each group gets its own request, recorded in Request History with a Request ID, and goes through the Delete Group workflow. Group Self-Service admins are asked whether to use workflow and can delete at once; group owners who are not admins cannot skip it.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Group Self-Service admins choose to delete now or submit for approval, and Avabot reports an outcome for each group.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A group deletion completes when the group is deleted from the directory and removed from Group Self-Service management, once the request is approved, or at once when a Group Self-Service admin applies it. Each group gets its own request, recorded in Request History with a Request ID, and the delete is recorded in the activity log. One completed group deletion = one Secure Outcome.
Evidence
- A Request ID for each group in Request History (filter Delete Group, exportable)
- An activity-log entry
- An outcome for each group, in Avabot
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Group Deletion
Pay per completed group deletion. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Delete Group, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed group deletions only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved or applied, each group is deleted from the directory and removed from Group Self-Service management |
| Evidence | Silent failures and missing audit trails | A Request ID for each group in Request History and an activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Groups Delete Group Touches
Delete Group runs through the group's own Group Self-Service connector, such as Active Directory, AWS or Okta.
- AWS
- Okta
- Microsoft
- Active Directory groups, through the Group Self-Service connector.
- Other Systems
- AWS and Okta groups, through their Group Self-Service connectors.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can a deleted group be recovered?
Not from Avatier. The group is deleted in the directory and removed from Group Self-Service.
Can I delete several groups at once?
Yes. Select multiple groups on the web, or name several in Avabot; each group gets its own request.
Do groups get deleted automatically?
Yes, when a group's expiration date passes. Change Group Expiration sets that date.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Delete Group
You've Automated the System. Now Secure the Groups.
Pick the groups you no longer need, accept the warning, and each deletion is recorded in Request History with a Request ID.