OneLogin - How to Decommission an Active Directory Server and OneLogin AD Connector Without Impacting Users (4383102)

Administrators preparing to decommission their on‑prem or VM AD server may experience concerns such as:

• Users deleted in OneLogin
• Passwords becoming unsynchronized
• Users stuck in a “Deleting” state in OneLogin
• Users potentially losing access to applications after AD shutdown
• Uncertainty about when it is safe to remove/delete the AD Connector

These issues typically occur due to:

• Active users still authenticating against AD via a OneLogin AD Connector
• Pending provisioning actions (such as admin approvals) blocking user deletion
• Password differences between AD, OneLogin, and other identity providers
• AD Connector still being referenced by users even after AD sync is disabled

1. Validate Authentication Sources

Before decommissioning an AD syncing users to OneLogin:

• Review how many users are still syncing and authenticating via the AD Connector dashboard [yourdomain.onelogin.com/directory]
• You can build a custom report to confirm which users authenticate against:
  • OneLogin Cloud Directory
  • Active Directory
  • Other identity providers (for example, Entra ID)

This can be achieved by filtering the directory in the report.

2. Address Users Stuck in “Deleting” Status

Users may remain in a Deleting state if:

• They have a Pending Admin Approval in an application with provisioning enabled

Fix:

• Temporarily assign a required license
• Approve the pending action
• The user will be immediately deleted once approval is completed and the license is made available

3. Check the Password Mappings and Password Cache

• Ask the Account Owner, or if you are the account owner, go to the Account Settings and ensure "Enable password mapping" and "Enable directory fallback password cache" features are enabled/checked.
• If they are already checked, it means OneLogin already have a copy or a hash of the last used AD password

4. Transition Users to OneLogin Cloud Authentication

Rather than removing the AD Connector immediately:

• Test with a small set of users by building a Mapping to change the users' directory from AD to OneLogin for a group of users (filtering by a Role or Group) 
• Applying the Mapping will require those users to authenticate directly against the OneLogin Cloud Directory on their next login.
• Confirm successful login before expanding the Mapping to all users

This staged approach reduces the risk of authentication failures.

5. Remove / Delete the AD Connector

Once all users authenticate successfully via OneLogin Cloud, you can:

• Remove/Delete the AD Connector from OneLogin
• Decommission your AD server
• Monitor authentication and provisioning behaviour

Note that if you feel confident about users' passwords, simply deleting the AD connector, skipping step 4 above, will immediately move all users to OneLogin.