---
title: DeleteUser
summary: Deletes an external-domain Active Directory account, gated by the IP allow-list.
status: draft
owner: "Not determined from source"
last_reviewed: 2026-09-22
---

# DeleteUser (OP-05)

## Request and response

| Part | Type | Description |
| --- | --- | --- |
| `inUserId` | `String` | The `SamAccountName` of the account to delete. |

| Part | Type | Description |
| --- | --- | --- |
| `<return>` | `ADServiceResponse` | `Response` is `Success` (including when no principal was found) or `Failure`. `Message` carries the caught exception text on a `Failure`, otherwise empty. |

## WebMethod attributes

`<WebMethod()>` — bare, no arguments supplied.

## Steps

1. `CheckAccess()`; on denial return `AccessDenied()` ([BR-01](../business-rules.md#br-01-mutating-and-password-operations-require-an-approved-caller)).
2. Call H1 `GetContext` for the external domain into an unused local.
3. Call H2 `GetUserPrincipal` for the external domain.
4. Initialize the response sentinel to `Success`.
5. If a principal was found:
   - `userPrin.Delete()` inside `Try`.
     - On exception, set `Response = Failure`, `Message = ex.Message`.
   - `Finally` releases the principal.
6. If no principal was found, do nothing and fall through ([BR-18](../business-rules.md#br-18-deleting-a-non-existent-user-is-a-successful-no-op)) — a non-existent user and a directory-lookup failure both return `Success`; deletion is reported as idempotent but is not distinguishable from a silent failure.
7. Return the response sentinel.

## Process flow

```mermaid
flowchart TD
    A["Call DeleteUser"] --> B{"CheckAccess<br>HasAccess?"}
    B -->|"No"| C["Return AccessDenied"]
    B -->|"Yes"| D["GetUserPrincipal<br>external domain"]
    D -->|"Found"| E["userPrin.Delete<br>in Try/Catch"]
    E -.->|"Exception"| F["Set Failure + ex.Message"]
    E --> G["Return response"]
    F --> G
    D -->|"Nothing"| H["Fall through<br>leave Success"]
    H --> G
```

## Shared state effects

None — this operation touches no process-wide state; all locals are per-request.

## Error handling

The operation always returns a sentinel `ADServiceResponse`. It never surfaces a framework SOAP fault from a caught `Delete()` failure. See [Faults](../faults.md) for the service-wide fault model.

## Authorization

Gated by [BR-01](../business-rules.md#br-01-mutating-and-password-operations-require-an-approved-caller): the caller must pass the IP allow-list check enforced by `CheckAccess`. See [Authentication and authorization](../authentication-authorization.md).

## Related documentation
- [Service index](../index.md)
- [Overview](../overview.md)
- [Architecture](../architecture.md)
- [Activation and hosting](../activation-hosting.md)
- [Operations](../operations.md)
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Authentication and authorization](../authentication-authorization.md)
- [Configuration](../configuration.md)
- [Dependencies](../dependencies.md)
- [Faults](../faults.md)
- [Operational runbook](../operational-runbook.md)
- [Tech debt](../tech-debt.md)

## Sources
- `src\ADUserServices\clsADUserServices.asmx.vb` (lines 270-295)