We struggled a bit with this, unlinking accounts from Google, without removing the Google IDP.
So first step was to unlink (there is no UI for this):
#!/bin/bash
orgid=""
orgtoken=""
while read p; do
z="$(echo -e $p | sed -z 's/\r//g')"
echo "{\"email\":\"$z\"}" > data.json
rm scim.json
curl -H "Content-Type: application/json" -H "Authorization: Bearer $orgtoken" -X POST -d @data.json https://api.atlassian.com/admin/user-provisioning/v1/org/$orgid/get-scim-links-for-email >> scim.json
scimid=$(cat scim.json | jq .scimLinks[].scimUserId )
scimdir=$(cat scim.json | jq .scimLinks[].directoryId )
scimid=$(echo $scimid | sed -z 's/\"//g')
curl -H "Authorization: Bearer $orgtoken" -X PATCH "https://api.atlassian.com/admin/user-provisioning/v1/org/$orgid/scimDirectoryId/$scimdir/scimUserId/$scimid/unlink" >> $scimid.json
done < unlink-scim.csv |
unlink-scim.csv is a file with the users email addresse, one on each line. orgid is You Organisation Id orgtoken is a Organisation API Toke, not a Personal Token |
After unlinking, You need to use the same file to unclaim all accounts:
Now they can be claimed by another Organisation