[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Managing apps (SSO) > OIDC apps > Deactivating and deleting an app

# Deactivating and deleting an OIDC application in Yandex Identity Hub


OIDC apps can be managed by users with the `organization-manager.oauthApplications.admin` [role](../../security/index.md#organization-manager-oauthApplications-admin) or higher.

## Deactivate the application {#deactivate}

If you need to temporarily disable authentication in an external app using the [OpenID Connect](https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)) (OIDC) single sign-on for your [organization’s](../../concepts/organization.md) users, deactivate the relevant [OIDC application](../../concepts/applications.md#oidc) in Yandex Identity Hub:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
  1. Next to the OIDC application you want to deactivate, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![pause](../../../_assets/console-icons/pause.svg) **Deactivate**.
  1. In the window that opens, confirm the operation.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for deactivating an OIDC app:

     ```bash
     yc organization-manager idp application oauth application suspend --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager idp application oauth application suspend <app_ID>
     ```

     Result:

     ```text
     id: ek0o663g4rs2********
     name: test-oidc-app
     organization_id: bpf2c65rqcl8********
     group_claims_settings:
       group_distribution_type: NONE
     client_grant:
       client_id: ajeqqip130i1********
       authorized_scopes:
         - openid
     status: SUSPENDED
     created_at: "2025-10-21T10:51:28.790866Z"
     updated_at: "2025-10-21T11:28:09.167252Z"
     ```

- API {#api}

  Use the [Application.Suspend](../../idp/application/oauth/api-ref/Application/suspend.md) REST API method for the [Application](../../idp/application/oauth/api-ref/Application/index.md) resource or the [ApplicationService/Suspend](../../idp/application/oauth/api-ref/grpc/Application/suspend.md) gRPC API call.

{% endlist %}

This will deactivate the OIDC application and switch its status to `Suspended`, and the users will no longer be able to use it for authentication in the relevant external app.

## Activate the application {#reactivate}

If you need to restore the ability of your organization’s users to authenticate in an external app using the OIDC single sign-on, activate the OIDC application in Yandex Identity Hub:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
  1. Next to the OIDC application you want to activate, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![arrows-rotate-right](../../../_assets/console-icons/arrows-rotate-right.svg) **Activate**.
  1. In the window that opens, confirm the operation.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for activating an OIDC app:

     ```bash
     yc organization-manager idp application oauth application reactivate --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager idp application oauth application reactivate <app_ID>
     ```

     Result:

     ```text
     id: ek0o663g4rs2********
     name: test-oidc-app
     organization_id: bpf2c65rqcl8********
     group_claims_settings:
       group_distribution_type: NONE
     client_grant:
       client_id: ajeqqip130i1********
       authorized_scopes:
         - openid
     status: ACTIVE
     created_at: "2025-10-21T10:51:28.790866Z"
     updated_at: "2025-10-21T11:28:09.167252Z"
     ```

- API {#api}

  Use the [Application.Reactivate](../../idp/application/oauth/api-ref/Application/reactivate.md) REST API method for the [Application](../../idp/application/oauth/api-ref/Application/index.md) resource or the [ApplicationService/Reactivate](../../idp/application/oauth/api-ref/grpc/Application/reactivate.md) gRPC API call.

{% endlist %}

This will activate the OIDC application, switch its status to `Active`, and enable the users added to the application to use it for authentication in the external app again.

## Delete the application {#delete}

To delete an OIDC application:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
  1. Next to the OIDC application you want to delete, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**.
  1. In the window that opens, confirm the operation.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for deleting an OIDC app:

     ```bash
     yc organization-manager idp application oauth application delete --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager idp application oauth application delete <app_ID>
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. To delete the OIDC app, delete the relevant resource from the Terraform configuration file:

     Example of an OIDC application description in the Terraform configuration:

     ```hcl
     resource "yandex_organizationmanager_idp_application_oauth_application" "example_oidc_app" {
       organization_id = "<organization_ID>"
       name            = "<application_name>"
       description     = "<application_description>"
    
       client_grant = {
         client_id         = "<OAuth_client_ID>"
         authorized_scopes = ["<attribute_1>", "<attribute_2>"]
       }
    
       group_claims_settings = {
         group_distribution_type = "ALL_GROUPS"
       }
    
       labels = {
         "<key_1>" = "<value_1>"
         "<key_2>" = "<value_2>"
       }
     }
     ```

     Where:

     * `organization_id`: [ID of the organization](../organization-get-id.md) the OIDC app resides in.
     * `name`: OIDC app name.
     * `description`: OIDC app description.
     * `client_grant`: OAuth client connection settings:
       * `client_id`: OAuth client ID.
       * `authorized_scopes`: User attributes available to the service provider.
     * `group_claims_settings`: Settings for sending user groups to the service provider:
       * `group_distribution_type`: Group distribution type.
     * `labels`: List of [labels](../../../resource-manager/concepts/labels.md).

     For more on the properties of the `yandex_organizationmanager_idp_application_oauth_application` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_oauth_application.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     Terraform will delete the OIDC app resource. You can check the resource deletion in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../../cli/index.md) command:

     ```bash
     yc organization-manager idp application oauth application list --organization-id <organization_ID>
     ```

- API {#api}

  Use the [Application.Delete](../../idp/application/oauth/api-ref/Application/delete.md) REST API method for the [Application](../../idp/application/oauth/api-ref/Application/index.md) resource or the [ApplicationService/Delete](../../idp/application/oauth/api-ref/grpc/Application/delete.md) gRPC API call.

{% endlist %}

This will delete the OIDC application, and the users will no longer be able to use it for authentication in the external app.

#### Useful links {#see-also}

* [Creating an OIDC application in Yandex Identity Hub](oidc-create.md)
* [Updating an OIDC application in Yandex Identity Hub](oidc-update.md)
* [Adding a user](../add-account.md)
* [OIDC apps](../../concepts/applications.md#oidc)
* [Managing user groups](../manage-groups.md)