[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Managing apps (SSO) > SAML apps > Deactivating and deleting an app

# Deactivating and deleting a SAML application in Yandex Identity Hub


SAML apps can be managed by users with the `organization-manager.samlApplications.admin` [role](../../security/index.md#organization-manager-samlApplications-admin) or higher.

## Deactivate the application {#deactivate}

If you need to temporarily disable [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language)-based single sign-on authentication to an external app for the users of your [organization](../../concepts/organization.md), deactivate the relevant [SAML application](../../concepts/applications.md#saml) in Yandex Identity Hub:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
  1. In the row with the SAML application you want to deactivate, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![pause](../../../_assets/console-icons/pause.svg) **Deactivate**.
  1. In the window that opens, confirm the operation.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for deactivating a SAML app:

     ```bash
     yc organization-manager idp application saml application suspend --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager idp application saml application suspend <app_ID>
     ```

     Result:

     ```text
     id: ek0o663g4rs2********
     name: test-saml-app
     organization_id: bpf2c65rqcl8********
     group_claims_settings:
       group_distribution_type: NONE
     status: SUSPENDED
     created_at: "2025-10-21T10:51:28.790866Z"
     updated_at: "2025-10-21T11:28:09.167252Z"
     ```

- API {#api}

  Use the [Application.Suspend](../../idp/application/saml/api-ref/Application/suspend.md) REST API method for the [Application](../../idp/application/saml/api-ref/Application/index.md) resource or the [ApplicationService/Suspend](../../idp/application/saml/api-ref/grpc/Application/suspend.md) gRPC API call.

{% endlist %}

As a result, the SAML application will be deactivated and switch to the `Suspended` status, and the users will no longer be able to use it for authentication in the relevant external app.

## Activate the application {#reactivate}

If you need to restore the ability of your organization users to authenticate in an external app using the SAML-based single sign-on, activate the relevant SAML application in Yandex Identity Hub:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
  1. In the row with the SAML application you want to activate, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![arrows-rotate-right](../../../_assets/console-icons/arrows-rotate-right.svg) **Activate**.
  1. In the window that opens, confirm the operation.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for activating a SAML app:

     ```bash
     yc organization-manager idp application saml application reactivate --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager idp application saml application reactivate <app_ID>
     ```

     Result:

     ```text
     id: ek0o663g4rs2********
     name: test-saml-app
     organization_id: bpf2c65rqcl8********
     group_claims_settings:
       group_distribution_type: NONE
     status: ACTIVE
     created_at: "2025-10-21T10:51:28.790866Z"
     updated_at: "2025-10-21T11:28:09.167252Z"
     ```

- API {#api}

  Use the [Application.Reactivate](../../idp/application/saml/api-ref/Application/reactivate.md) REST API method for the [Application](../../idp/application/saml/api-ref/Application/index.md) resource or the [ApplicationService/Reactivate](../../idp/application/saml/api-ref/grpc/Application/reactivate.md) gRPC API call.

{% endlist %}

As a result, the SAML application will be activated and switch to the `Active` status, and the users added to the application will again be able to use it for authentication in the external app.

## Delete the application {#delete}

To delete a SAML application:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
  1. In the row with the SAML application you want to delete, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**.
  1. In the window that opens, confirm the operation.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for deleting a SAML app:

     ```bash
     yc organization-manager idp application saml application delete --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager idp application saml application delete <app_ID>
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Open the Terraform configuration file and delete the fragment describing the SAML application:

     Example of a SAML application description in the Terraform configuration:

     ```hcl
     resource "yandex_organizationmanager_idp_application_saml_application" "saml_app" {
       organization_id = "bpfd1n2bnoqr********"
       name            = "my-saml-app"

       service_provider = {
         entity_id = "https://example.com/saml/metadata"
         acs_urls       = [
           {
             url = "http://localhost"
           }
         ]
       }
     }
     ```

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the deletion of the resources in the [Cloud Center UI](https://center.yandex.cloud/organization).

- API {#api}

  Use the [Application.Delete](../../idp/application/saml/api-ref/Application/delete.md) REST API method for the [Application](../../idp/application/saml/api-ref/Application/index.md) resource or the [ApplicationService/Delete](../../idp/application/saml/api-ref/grpc/Application/delete.md) gRPC API call.

{% endlist %}

As a result, the SAML application will be deleted, and the users will no longer be able to use it for authentication in the external app.

#### Useful links {#see-also}

* [Creating a SAML application in Yandex Identity Hub](saml-create.md)
* [Updating a SAML app in Yandex Identity Hub](saml-update.md)
* [Adding a user](../add-account.md)
* [SAML applications](../../concepts/applications.md#saml)
* [Managing user groups](../manage-groups.md)