How to bulk disenroll users in ADSelfService Plus?

In this article

1. Objective
2. Steps to perform bulk disenrollment
3. Validation and confirmation
4. How to reach support

Objective

This article explains how to perform bulk disenrollment of users in ADSelfService Plus, enabling administrators to efficiently manage user licenses, restrict access to only the required authenticators, and save time by avoiding manual, individual disenrollments. Once users are disenrolled, they will no longer be able to verify their identities using the authenticators from which they have been removed.

Steps to perform bulk disenrollment

Administrators can choose between two options to perform bulk disenrollment:

1. Select multiple users from Enrollment Reports
2. Import users from a CSV file

Method 1: Select multiple users from the enrollment reports

1. Log into ADSelfService Plus as an administrator.
2. Navigate to Reports > MFA Reports > MFA Enrolled Users Reports.
3. Select the desired Domain(s) or OU(s).
4. Select the Enrollment Status as Enrolled or Partially Enrolled.
5. Select the Enrollment Authenticators to filter by which the user has enrolled.
6. Click Generate.
7. From the report generated, select the users to be disenrolled using the check box on the left side of the generated report. Click Disenroll next to the search button.

   

8. In the Bulk Disenroll pop-up that opens, select the authenticators from which you want to disenroll the user(s). You may also click All Authenticators to disenroll the users from all authenticators.
9. Click OK.

   

10. Confirm the disenrollment by clicking Yes in the Confirm Action dialog box. You can also click the Free up the license from the selected user(s) checkbox to remove the selected users from all enrolled authenticators and free up their ADSelfService Plus licenses.

    Note: If you select the Free up the license from the selected user(s) checkbox, the users will be unlicensed and will also lose their administrator and technician privileges in the product.

    

Method 2: Import users from a CSV file to disenroll

1. Log into ADSelfService Plus as an administrator.
2. Navigate to Reports > MFA Reports > MFA Enrolled Users Reports.
3. Select the desired Domain(s) or OU(s).
4. Click the Bulk Disenroll button on the right side of the report.

   

5. From the Disenroll based on drop-down list, select the AD attribute that will be used as the basis for disenrollment.

   Note: The attribute value should be included in the CSV file.

6. In the Select the CSV file field, click Browse to upload a CSV file containing the enrolled users list.
7. Select a method of File Encoding from the drop-down list (by default, it is UTF-8).
8. Click Import.

   

9. Once the CSV file is uploaded, you can select the authenticators you want to disenroll the user(s) from. You may also click All Authenticators to disenroll the users from all authenticators. Click OK.

   

10. Confirm the disenrollment by clicking Yes in Confirm Action dialog box. You can also click the Free up the license from the selected user(s) checkbox to remove the selected users from all enrolled authenticators and free up their ADSelfService Plus licenses.

    Note: If this checkbox is selected, the user(s)'s licenses will be freed up, and their admin or technician privileges, if any, will also be removed

    

Validation and confirmation

Once you have disenrolled users, check the MFA Enrolled Users Report to confirm that they are no longer listed as enrolled. You can re-enroll them either automatically using quick enrollment methods or by having the users enroll manually. To reclaim the unused ADSelfService Plus licenses from disenrolled users, refer to the Restrict Users setting.

How to reach support

For further assistance, contact our support team here.

Last updated on: 26th September,2025.