Add revocation reasons (#7473)

sven-bitwarden · web-flow · commit 1dcbf278eb35 · 2026-04-27T12:27:01.000-05:00
diff --git a/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs b/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs
@@ -106,7 +106,8 @@ public async Task<IActionResult> Put(Guid organizationId, Guid id, [FromBody] Sc
                 new RevokeOrganizationUsersRequest(
                     organizationId,
                     [id],
-                    new SystemUser(EventSystemUser.SCIM)));
+                    new SystemUser(EventSystemUser.SCIM),
+                    RevocationReason.Manual));
 
             var errors = results.Select(x => x.Result.Match(
                 y => $"{y.Message} for user {x.Id}",
diff --git a/bitwarden_license/src/Scim/Users/PatchUserCommand.cs b/bitwarden_license/src/Scim/Users/PatchUserCommand.cs
@@ -107,7 +107,7 @@ private async Task<bool> HandleActiveOperationAsync(Core.Entities.OrganizationUs
         }
         else if (!active && orgUser.Status != OrganizationUserStatusType.Revoked)
         {
-            await _revokeOrganizationUserCommand.RevokeUserAsync(orgUser, EventSystemUser.SCIM);
+            await _revokeOrganizationUserCommand.RevokeUserAsync(orgUser, EventSystemUser.SCIM, RevocationReason.Manual);
             return true;
         }
         return false;
diff --git a/bitwarden_license/test/Scim.Test/Users/PatchUserCommandTests.cs b/bitwarden_license/test/Scim.Test/Users/PatchUserCommandTests.cs
@@ -102,7 +102,7 @@ public async Task PatchUser_RevokePath_Success(SutProvider<PatchUserCommand> sut
 
         await sutProvider.Sut.PatchUserAsync(organizationUser.OrganizationId, organizationUser.Id, scimPatchModel);
 
-        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().Received(1).RevokeUserAsync(organizationUser, EventSystemUser.SCIM);
+        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().Received(1).RevokeUserAsync(organizationUser, EventSystemUser.SCIM, RevocationReason.Manual);
     }
 
     [Theory]
@@ -130,7 +130,7 @@ public async Task PatchUser_RevokeValue_Success(SutProvider<PatchUserCommand> su
 
         await sutProvider.Sut.PatchUserAsync(organizationUser.OrganizationId, organizationUser.Id, scimPatchModel);
 
-        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().Received(1).RevokeUserAsync(organizationUser, EventSystemUser.SCIM);
+        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().Received(1).RevokeUserAsync(organizationUser, EventSystemUser.SCIM, RevocationReason.Manual);
     }
 
     [Theory]
@@ -150,7 +150,7 @@ public async Task PatchUser_NoAction_Success(SutProvider<PatchUserCommand> sutPr
         await sutProvider.Sut.PatchUserAsync(organizationUser.OrganizationId, organizationUser.Id, scimPatchModel);
 
         await sutProvider.GetDependency<IRestoreOrganizationUserCommand>().DidNotReceiveWithAnyArgs().RestoreUserAsync(default, EventSystemUser.SCIM);
-        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().DidNotReceiveWithAnyArgs().RevokeUserAsync(default, EventSystemUser.SCIM);
+        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().DidNotReceiveWithAnyArgs().RevokeUserAsync(default, EventSystemUser.SCIM, default);
     }
 
     [Theory]
@@ -380,7 +380,7 @@ public async Task PatchUser_UnsupportedOperation_LogsWarningAndSucceeds(SutProvi
 
         // Verify no restore or revoke operations were called
         await sutProvider.GetDependency<IRestoreOrganizationUserCommand>().DidNotReceiveWithAnyArgs().RestoreUserAsync(default, EventSystemUser.SCIM);
-        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().DidNotReceiveWithAnyArgs().RevokeUserAsync(default, EventSystemUser.SCIM);
+        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().DidNotReceiveWithAnyArgs().RevokeUserAsync(default, EventSystemUser.SCIM, default);
     }
 
     [Theory]
@@ -415,7 +415,7 @@ public async Task PatchUser_ActiveAndExternalIdFromValue_Success(SutProvider<Pat
         await sutProvider.Sut.PatchUserAsync(organizationUser.OrganizationId, organizationUser.Id, scimPatchModel);
 
         // Verify both operations were processed
-        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().Received(1).RevokeUserAsync(organizationUser, EventSystemUser.SCIM);
+        await sutProvider.GetDependency<IRevokeOrganizationUserCommand>().Received(1).RevokeUserAsync(organizationUser, EventSystemUser.SCIM, RevocationReason.Manual);
         await sutProvider.GetDependency<IOrganizationUserRepository>().Received(1).ReplaceAsync(
             Arg.Is<OrganizationUser>(ou => ou.ExternalId == newExternalId));
     }
diff --git a/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs b/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs
@@ -644,7 +644,7 @@ public async Task<ListResponseModel<OrganizationUserBulkResponseModel>> PostBulk
     [Authorize<ManageUsersRequirement>]
     public async Task RevokeAsync(Guid orgId, Guid id)
     {
-        await RestoreOrRevokeUserAsync(orgId, id, _revokeOrganizationUserCommand.RevokeUserAsync);
+        await RestoreOrRevokeUserAsync(orgId, id, (orgUser, userId) => _revokeOrganizationUserCommand.RevokeUserAsync(orgUser, userId, RevocationReason.Manual));
     }
 
     [HttpPut("revoke-self")]
@@ -683,7 +683,8 @@ public async Task<ListResponseModel<OrganizationUserBulkResponseModel>> BulkRevo
             new V2_RevokeOrganizationUserCommand.RevokeOrganizationUsersRequest(
                 orgId,
                 model.Ids.ToArray(),
-                new StandardUser(currentUserId.Value, await _currentContext.OrganizationOwner(orgId))));
+                new StandardUser(currentUserId.Value, await _currentContext.OrganizationOwner(orgId)),
+                RevocationReason.Manual));
 
         return new ListResponseModel<OrganizationUserBulkResponseModel>(results
             .Select(result => new OrganizationUserBulkResponseModel(result.Id,
diff --git a/src/Api/AdminConsole/Public/Controllers/MembersController.cs b/src/Api/AdminConsole/Public/Controllers/MembersController.cs
@@ -339,7 +339,8 @@ public async Task<IActionResult> Revoke(Guid id)
         var request = new RevokeOrganizationUsersRequest(
             _currentContext.OrganizationId!.Value,
             [id],
-            new SystemUser(EventSystemUser.PublicApi)
+            new SystemUser(EventSystemUser.PublicApi),
+            RevocationReason.Manual
         );
 
         var results = await _revokeOrganizationUserCommandV2.RevokeUsersAsync(request);
diff --git a/src/Core/AdminConsole/OrganizationFeatures/AccountRecovery/v2/AdminRecoverAccountCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/AccountRecovery/v2/AdminRecoverAccountCommand.cs
@@ -125,7 +125,8 @@ await revokeNonCompliantOrganizationUserCommand.RevokeNonCompliantOrganizationUs
                     new RevokeOrganizationUsersRequest(
                         o.OrganizationId,
                         [new OrganizationUserUserDetails { Id = o.OrganizationUserId, OrganizationId = o.OrganizationId }],
-                        new SystemUser(EventSystemUser.TwoFactorDisabled)));
+                        new SystemUser(EventSystemUser.TwoFactorDisabled),
+                        RevocationReason.TwoFactorPolicyNonCompliance));
                 await mailService.SendOrganizationUserRevokedForTwoFactorPolicyEmailAsync(organization.DisplayName(), user.Email);
             }).ToArray();
 
diff --git a/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Requests/RevokeOrganizationUserRequest.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Requests/RevokeOrganizationUserRequest.cs
@@ -1,13 +1,15 @@
 ﻿using Bit.Core.AdminConsole.Models.Data;
+using Bit.Core.Enums;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Requests;
 
 public record RevokeOrganizationUsersRequest(
     Guid OrganizationId,
     IEnumerable<OrganizationUserUserDetails> OrganizationUsers,
-    IActingUser ActionPerformedBy)
+    IActingUser ActionPerformedBy,
+    RevocationReason RevocationReason)
 {
-    public RevokeOrganizationUsersRequest(Guid organizationId, OrganizationUserUserDetails organizationUser, IActingUser actionPerformedBy)
-        : this(organizationId, [organizationUser], actionPerformedBy) { }
+    public RevokeOrganizationUsersRequest(Guid organizationId, OrganizationUserUserDetails organizationUser, IActingUser actionPerformedBy, RevocationReason revocationReason)
+        : this(organizationId, [organizationUser], actionPerformedBy, revocationReason) { }
 }
diff --git a/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeNonCompliantOrganizationUserCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeNonCompliantOrganizationUserCommand.cs
@@ -30,33 +30,42 @@ public async Task<CommandResult> RevokeNonCompliantOrganizationUsersAsync(Revoke
             return validationResult;
         }
 
-        await organizationUserRepository.RevokeManyAsync(request.OrganizationUsers.Select(x => x.Id));
+        await organizationUserRepository.RevokeManyAsync(request.OrganizationUsers.Select(x => x.Id), request.RevocationReason);
 
         var now = timeProvider.GetUtcNow();
 
+        var eventType = MapRevocationReasonToEventType(request.RevocationReason);
+
         switch (request.ActionPerformedBy)
         {
             case StandardUser:
                 await eventService.LogOrganizationUserEventsAsync(
-                    request.OrganizationUsers.Select(x => GetRevokedUserEventTuple(x, now)));
+                    request.OrganizationUsers.Select(x => GetRevokedUserEventTuple(x, eventType, now)));
                 break;
             case SystemUser { SystemUserType: not null } loggableSystem:
                 await eventService.LogOrganizationUserEventsAsync(
                     request.OrganizationUsers.Select(x =>
-                        GetRevokedUserEventBySystemUserTuple(x, loggableSystem.SystemUserType.Value, now)));
+                        GetRevokedUserEventBySystemUserTuple(x, eventType, loggableSystem.SystemUserType.Value, now)));
                 break;
         }
 
         return validationResult;
     }
 
+    private static EventType MapRevocationReasonToEventType(RevocationReason reason) => reason switch
+    {
+        RevocationReason.TwoFactorPolicyNonCompliance => EventType.OrganizationUser_Revoked_TwoFactorNonCompliance,
+        RevocationReason.SingleOrgPolicyNonCompliance => EventType.OrganizationUser_Revoked_SingleOrganizationNonCompliance,
+        _ => EventType.OrganizationUser_Revoked
+    };
+
     private static (OrganizationUserUserDetails organizationUser, EventType eventType, DateTime? time) GetRevokedUserEventTuple(
-        OrganizationUserUserDetails organizationUser, DateTimeOffset dateTimeOffset) =>
-        new(organizationUser, EventType.OrganizationUser_Revoked, dateTimeOffset.UtcDateTime);
+        OrganizationUserUserDetails organizationUser, EventType eventType, DateTimeOffset dateTimeOffset) =>
+        new(organizationUser, eventType, dateTimeOffset.UtcDateTime);
 
     private static (OrganizationUserUserDetails organizationUser, EventType eventType, EventSystemUser eventSystemUser, DateTime? time) GetRevokedUserEventBySystemUserTuple(
-        OrganizationUserUserDetails organizationUser, EventSystemUser systemUser, DateTimeOffset dateTimeOffset) => new(organizationUser,
-        EventType.OrganizationUser_Revoked, systemUser, dateTimeOffset.UtcDateTime);
+        OrganizationUserUserDetails organizationUser, EventType eventType, EventSystemUser systemUser, DateTimeOffset dateTimeOffset) => new(organizationUser,
+        eventType, systemUser, dateTimeOffset.UtcDateTime);
 
     private async Task<CommandResult> ValidateAsync(RevokeOrganizationUsersRequest request)
     {
diff --git a/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v1/IRevokeOrganizationUserCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v1/IRevokeOrganizationUserCommand.cs
@@ -5,6 +5,6 @@ namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUse
 
 public interface IRevokeOrganizationUserCommand
 {
-    Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revokingUserId);
-    Task RevokeUserAsync(OrganizationUser organizationUser, EventSystemUser systemUser);
+    Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revokingUserId, RevocationReason reason);
+    Task RevokeUserAsync(OrganizationUser organizationUser, EventSystemUser systemUser, RevocationReason reason);
 }
diff --git a/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v1/RevokeOrganizationUserCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v1/RevokeOrganizationUserCommand.cs
@@ -17,7 +17,7 @@ public class RevokeOrganizationUserCommand(
     IHasConfirmedOwnersExceptQuery hasConfirmedOwnersExceptQuery)
     : IRevokeOrganizationUserCommand
 {
-    public async Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revokingUserId)
+    public async Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revokingUserId, RevocationReason reason)
     {
         if (revokingUserId.HasValue && organizationUser.UserId == revokingUserId.Value)
         {
@@ -30,7 +30,7 @@ public async Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revok
             throw new BadRequestException("Only owners can revoke other owners.");
         }
 
-        await RepositoryRevokeUserAsync(organizationUser);
+        await RepositoryRevokeUserAsync(organizationUser, reason);
         await eventService.LogOrganizationUserEventAsync(organizationUser, EventType.OrganizationUser_Revoked);
 
         if (organizationUser.UserId.HasValue)
@@ -40,9 +40,9 @@ public async Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revok
     }
 
     public async Task RevokeUserAsync(OrganizationUser organizationUser,
-        EventSystemUser systemUser)
+        EventSystemUser systemUser, RevocationReason reason)
     {
-        await RepositoryRevokeUserAsync(organizationUser);
+        await RepositoryRevokeUserAsync(organizationUser, reason);
         await eventService.LogOrganizationUserEventAsync(organizationUser, EventType.OrganizationUser_Revoked,
             systemUser);
 
@@ -52,7 +52,7 @@ await eventService.LogOrganizationUserEventAsync(organizationUser, EventType.Org
         }
     }
 
-    private async Task RepositoryRevokeUserAsync(OrganizationUser organizationUser)
+    private async Task RepositoryRevokeUserAsync(OrganizationUser organizationUser, RevocationReason reason)
     {
         if (organizationUser.Status == OrganizationUserStatusType.Revoked)
         {
@@ -65,7 +65,8 @@ private async Task RepositoryRevokeUserAsync(OrganizationUser organizationUser)
             throw new BadRequestException("Organization must have at least one confirmed owner.");
         }
 
-        await organizationUserRepository.RevokeAsync(organizationUser.Id);
+        await organizationUserRepository.RevokeAsync(organizationUser.Id, reason);
         organizationUser.Status = OrganizationUserStatusType.Revoked;
+        organizationUser.RevocationReason = reason;
     }
 }
diff --git a/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUserCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUserCommand.cs
@@ -27,7 +27,7 @@ public async Task<IEnumerable<BulkCommandResult>> RevokeUsersAsync(RevokeOrganiz
 
         var validUsers = results.Where(r => r.IsValid).Select(r => r.Request).ToList();
 
-        await RevokeValidUsersAsync(validUsers);
+        await RevokeValidUsersAsync(validUsers, request.RevocationReason);
 
         await Task.WhenAll(
             LogRevokedOrganizationUsersAsync(validUsers, request.PerformedBy),
@@ -53,17 +53,18 @@ private async Task<RevokeOrganizationUsersValidationRequest> CreateValidationReq
         return new RevokeOrganizationUsersValidationRequest(
             request.OrganizationId,
             organizationUserToRevoke,
-            request.PerformedBy);
+            request.PerformedBy,
+            request.RevocationReason);
     }
 
-    private async Task RevokeValidUsersAsync(ICollection<OrganizationUser> validUsers)
+    private async Task RevokeValidUsersAsync(ICollection<OrganizationUser> validUsers, RevocationReason reason)
     {
         if (validUsers.Count == 0)
         {
             return;
         }
 
-        await organizationUserRepository.RevokeManyAsync(validUsers.Select(u => u.Id));
+        await organizationUserRepository.RevokeManyAsync(validUsers.Select(u => u.Id), reason);
     }
 
     private async Task LogRevokedOrganizationUsersAsync(
diff --git a/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUsersRequest.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUsersRequest.cs
@@ -1,18 +1,21 @@
 ﻿using Bit.Core.AdminConsole.Models.Data;
 using Bit.Core.Entities;
+using Bit.Core.Enums;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
 
 public record RevokeOrganizationUsersRequest(
     Guid OrganizationId,
     ICollection<Guid> OrganizationUserIdsToRevoke,
-    IActingUser PerformedBy
+    IActingUser PerformedBy,
+    RevocationReason RevocationReason
 );
 
 public record RevokeOrganizationUsersValidationRequest(
     Guid OrganizationId,
     ICollection<OrganizationUser> OrganizationUsersToRevoke,
-    IActingUser PerformedBy
+    IActingUser PerformedBy,
+    RevocationReason RevocationReason
 )
 {
     public ICollection<Guid> OrganizationUserIdsToRevoke => OrganizationUsersToRevoke.Select(x => x.Id).ToArray();
diff --git a/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/SelfRevokeUser/SelfRevokeOrganizationUserCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/SelfRevokeUser/SelfRevokeOrganizationUserCommand.cs
@@ -47,7 +47,7 @@ public async Task<CommandResult> SelfRevokeUserAsync(Guid organizationId, Guid u
             }
         }
 
-        await organizationUserRepository.RevokeAsync(organizationUser.Id);
+        await organizationUserRepository.RevokeAsync(organizationUser.Id, RevocationReason.OrganizationDataOwnershipPolicyNonCompliance);
         await eventService.LogOrganizationUserEventAsync(organizationUser, EventType.OrganizationUser_SelfRevoked);
         await pushNotificationService.PushSyncOrgKeysAsync(organizationUser.UserId!.Value);
 
diff --git a/src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/SingleOrgPolicyEventHandler.cs b/src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/SingleOrgPolicyEventHandler.cs
@@ -115,7 +115,10 @@ private async Task RevokeNonCompliantUsersAsync(Guid organizationId, IActingUser
                 uo.Status != OrganizationUserStatusType.Invited)).ToList();
 
         var commandResult = await _revokeNonCompliantOrganizationUserCommand.RevokeNonCompliantOrganizationUsersAsync(
-            new RevokeOrganizationUsersRequest(organizationId, usersToRevoke, performedBy));
+            new RevokeOrganizationUsersRequest(organizationId,
+                usersToRevoke,
+                performedBy,
+                RevocationReason.SingleOrgPolicyNonCompliance));
 
         if (commandResult.HasErrors)
         {
diff --git a/src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/TwoFactorAuthenticationPolicyEventHandler.cs b/src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/TwoFactorAuthenticationPolicyEventHandler.cs
@@ -97,7 +97,10 @@ private async Task RevokeNonCompliantUsersAsync(Guid organizationId, IActingUser
         }
 
         var commandResult = await _revokeNonCompliantOrganizationUserCommand.RevokeNonCompliantOrganizationUsersAsync(
-            new RevokeOrganizationUsersRequest(organizationId, nonCompliantUsers.Select(x => x.user), performedBy));
+            new RevokeOrganizationUsersRequest(organizationId,
+                nonCompliantUsers.Select(x => x.user),
+                performedBy,
+                RevocationReason.TwoFactorPolicyNonCompliance));
 
         if (commandResult.HasErrors)
         {
diff --git a/src/Core/AdminConsole/Repositories/IOrganizationUserRepository.cs b/src/Core/AdminConsole/Repositories/IOrganizationUserRepository.cs
@@ -66,7 +66,7 @@ Task<ICollection<OrganizationUserOrganizationDetails>> GetManyDetailsByUserAsync
     /// around <see cref="RevokeManyAsync"/> for single-user operations.
     /// </summary>
     /// <param name="id">The ID of the organization user to revoke.</param>
-    Task RevokeAsync(Guid id);
+    Task RevokeAsync(Guid id, RevocationReason reason);
     /// <summary>
     /// Restores access for a single revoked organization user. This is a convenience wrapper
     /// around <see cref="RestoreManyAsync"/> for single-user operations.
@@ -97,7 +97,7 @@ UpdateEncryptedDataForKeyRotation UpdateForKeyRotation(Guid userId,
     /// </summary>
     /// <param name="organizationUserIds">The IDs of the organization users to revoke.</param>
     /// <param name="reason">The reason for revocation. May be null if the reason is not known.</param>
-    Task RevokeManyAsync(IEnumerable<Guid> organizationUserIds, RevocationReason? reason = null);
+    Task RevokeManyAsync(IEnumerable<Guid> organizationUserIds, RevocationReason reason);
     /// <summary>
     /// Restores access for one or more revoked organization users, clearing their
     /// <see cref="Core.Entities.OrganizationUser.RevocationReason"/>. Only affects users
diff --git a/src/Core/Dirt/Enums/EventType.cs b/src/Core/Dirt/Enums/EventType.cs
@@ -68,6 +68,8 @@ public enum EventType : int
     OrganizationUser_AutomaticallyConfirmed = 1517,
     OrganizationUser_SelfRevoked = 1518, // User self-revoked due to declining organization data ownership policy
     OrganizationUser_AdminResetTwoFactor = 1519,
+    OrganizationUser_Revoked_TwoFactorNonCompliance = 1520,
+    OrganizationUser_Revoked_SingleOrganizationNonCompliance = 1521,
 
     Organization_Updated = 1600,
     Organization_PurgedVault = 1601,
diff --git a/src/Core/Services/Implementations/UserService.cs b/src/Core/Services/Implementations/UserService.cs
@@ -1117,7 +1117,8 @@ await _revokeNonCompliantOrganizationUserCommand.RevokeNonCompliantOrganizationU
                                 OrganizationId = o.OrganizationId
                             }
                         ],
-                        new SystemUser(EventSystemUser.TwoFactorDisabled)));
+                        new SystemUser(EventSystemUser.TwoFactorDisabled),
+                        RevocationReason.TwoFactorPolicyNonCompliance));
                 await _mailService.SendOrganizationUserRevokedForTwoFactorPolicyEmailAsync(organization.DisplayName(),
                     user.Email);
             }).ToArray();
diff --git a/src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationUserRepository.cs b/src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationUserRepository.cs
diff --git a/src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationUserRepository.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationUserRepository.cs
diff --git a/test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUserControllerBulkRevokeTests.cs b/test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUserControllerBulkRevokeTests.cs
diff --git a/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeNonCompliantOrganizationUserCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeNonCompliantOrganizationUserCommandTests.cs
diff --git a/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeOrganizationUserCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeOrganizationUserCommandTests.cs
diff --git a/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUserCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUserCommandTests.cs
diff --git a/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUsersValidatorTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUsersValidatorTests.cs
diff --git a/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/SelfRevokeUser/SelfRevokeOrganizationUserCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/SelfRevokeUser/SelfRevokeOrganizationUserCommandTests.cs
diff --git a/test/Infrastructure.IntegrationTest/AdminConsole/Repositories/OrganizationUserRepository/OrganizationUserRevocationTests.cs b/test/Infrastructure.IntegrationTest/AdminConsole/Repositories/OrganizationUserRepository/OrganizationUserRevocationTests.cs

Original file line number	Diff line number	Diff line change
`@@ -107,7 +107,7 @@ private async Task<bool> HandleActiveOperationAsync(Core.Entities.OrganizationUs`
`107`	`107`	`}`
`108`	`108`	`else if (!active && orgUser.Status != OrganizationUserStatusType.Revoked)`
`109`	`109`	`{`
`110`		`- await _revokeOrganizationUserCommand.RevokeUserAsync(orgUser, EventSystemUser.SCIM);`
	`110`	`+ await _revokeOrganizationUserCommand.RevokeUserAsync(orgUser, EventSystemUser.SCIM, RevocationReason.Manual);`
`111`	`111`	`return true;`
`112`	`112`	`}`
`113`	`113`	`return false;`
Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,6 @@ namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUse`
`5`	`5`
`6`	`6`	`public interface IRevokeOrganizationUserCommand`
`7`	`7`	`{`
`8`		`- Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revokingUserId);`
`9`		`- Task RevokeUserAsync(OrganizationUser organizationUser, EventSystemUser systemUser);`
	`8`	`+ Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revokingUserId, RevocationReason reason);`
	`9`	`+ Task RevokeUserAsync(OrganizationUser organizationUser, EventSystemUser systemUser, RevocationReason reason);`
`10`	`10`	`}`
Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ public class RevokeOrganizationUserCommand(`
`17`	`17`	`IHasConfirmedOwnersExceptQuery hasConfirmedOwnersExceptQuery)`
`18`	`18`	`: IRevokeOrganizationUserCommand`
`19`	`19`	`{`
`20`		`- public async Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revokingUserId)`
	`20`	`+ public async Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revokingUserId, RevocationReason reason)`
`21`	`21`	`{`
`22`	`22`	`if (revokingUserId.HasValue && organizationUser.UserId == revokingUserId.Value)`
`23`	`23`	`{`
`@@ -30,7 +30,7 @@ public async Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revok`
`30`	`30`	`throw new BadRequestException("Only owners can revoke other owners.");`
`31`	`31`	`}`
`32`	`32`
`33`		`- await RepositoryRevokeUserAsync(organizationUser);`
	`33`	`+ await RepositoryRevokeUserAsync(organizationUser, reason);`
`34`	`34`	`await eventService.LogOrganizationUserEventAsync(organizationUser, EventType.OrganizationUser_Revoked);`
`35`	`35`
`36`	`36`	`if (organizationUser.UserId.HasValue)`
`@@ -40,9 +40,9 @@ public async Task RevokeUserAsync(OrganizationUser organizationUser, Guid? revok`
`40`	`40`	`}`
`41`	`41`
`42`	`42`	`public async Task RevokeUserAsync(OrganizationUser organizationUser,`
`43`		`- EventSystemUser systemUser)`
	`43`	`+ EventSystemUser systemUser, RevocationReason reason)`
`44`	`44`	`{`
`45`		`- await RepositoryRevokeUserAsync(organizationUser);`
	`45`	`+ await RepositoryRevokeUserAsync(organizationUser, reason);`
`46`	`46`	`await eventService.LogOrganizationUserEventAsync(organizationUser, EventType.OrganizationUser_Revoked,`
`47`	`47`	`systemUser);`
`48`	`48`
`@@ -52,7 +52,7 @@ await eventService.LogOrganizationUserEventAsync(organizationUser, EventType.Org`
`52`	`52`	`}`
`53`	`53`	`}`
`54`	`54`
`55`		`- private async Task RepositoryRevokeUserAsync(OrganizationUser organizationUser)`
	`55`	`+ private async Task RepositoryRevokeUserAsync(OrganizationUser organizationUser, RevocationReason reason)`
`56`	`56`	`{`
`57`	`57`	`if (organizationUser.Status == OrganizationUserStatusType.Revoked)`
`58`	`58`	`{`
`@@ -65,7 +65,8 @@ private async Task RepositoryRevokeUserAsync(OrganizationUser organizationUser)`
`65`	`65`	`throw new BadRequestException("Organization must have at least one confirmed owner.");`
`66`	`66`	`}`
`67`	`67`
`68`		`- await organizationUserRepository.RevokeAsync(organizationUser.Id);`
	`68`	`+ await organizationUserRepository.RevokeAsync(organizationUser.Id, reason);`
`69`	`69`	`organizationUser.Status = OrganizationUserStatusType.Revoked;`
	`70`	`+ organizationUser.RevocationReason = reason;`
`70`	`71`	`}`
`71`	`72`	`}`