Deactivating and deleting a SAML application in Yandex Identity Hub
Note
This feature is at the Preview stage.
SAML apps can be managed by users with the organization-manager.samlApplications.admin role or higher.
Deactivate the application
If you need to temporarily disable authentication in an external app using the SAML-based single sign-on for your organization users, deactivate the relevant SAML application.
- Log in to Yandex Identity Hub.
- In the left-hand panel, select Apps.
- In the row with the SAML application you want to deactivate, click and select Deactivate.
- In the window that opens, confirm the operation.
If you do not have the Yandex Cloud CLI installed yet, install and initialize it.
By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.
-
See the description of the CLI command for deactivating a SAML app:
yc organization-manager idp application saml application suspend --help -
Run this command:
yc organization-manager idp application saml application suspend <app_ID>Result:
id: ek0o663g4rs2******** name: test-saml-app organization_id: bpf2c65rqcl8******** group_claims_settings: group_distribution_type: NONE status: SUSPENDED created_at: "2025-10-21T10:51:28.790866Z" updated_at: "2025-10-21T11:28:09.167252Z"
Use the Application.Suspend REST API method for the Application resource or the ApplicationService/Suspend gRPC API call.
As a result, the SAML application will be deactivated and switch to the Suspended status, and the users will no longer be able to use it for authentication in the relevant external app.
Activate the application
If you need to restore the ability of your organization users to authenticate in an external app using the SAML-based single sign-on, activate the relevant SAML application in Identity Hub:
- Log in to Yandex Identity Hub.
- In the left-hand panel, select Apps.
- In the row with the SAML application you want to activate, click and select Activate.
- In the window that opens, confirm the operation.
If you do not have the Yandex Cloud CLI installed yet, install and initialize it.
By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.
-
See the description of the CLI command for activating a SAML app:
yc organization-manager idp application saml application reactivate --help -
Run this command:
yc organization-manager idp application saml application reactivate <app_ID>Result:
id: ek0o663g4rs2******** name: test-saml-app organization_id: bpf2c65rqcl8******** group_claims_settings: group_distribution_type: NONE status: ACTIVE created_at: "2025-10-21T10:51:28.790866Z" updated_at: "2025-10-21T11:28:09.167252Z"
Use the Application.Reactivate REST API method for the Application resource or the ApplicationService/Reactivate gRPC API call.
As a result, the SAML application will be activated and switch to the Active status, and the users added to the application will again be able to use it for authentication in the external app.
Delete the application
To delete a SAML application:
- Log in to Yandex Identity Hub.
- In the left-hand panel, select Apps.
- In the row with the SAML application you want to delete, click and select Delete.
- In the window that opens, confirm the operation.
If you do not have the Yandex Cloud CLI installed yet, install and initialize it.
By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.
-
See the description of the CLI command for deleting a SAML app:
yc organization-manager idp application saml application delete --help -
Run this command:
yc organization-manager idp application saml application delete <app_ID>
Use the Application.Delete REST API method for the Application resource or the ApplicationService/Delete gRPC API call.
As a result, the SAML application will be deleted, and the users will no longer be able to use it for authentication in the external app.