Protecting app users

Protect people in your organization from automatic deprovisioning.
You can protect individual app users or members of particular teams from deprovisioning. This is useful if you have configured workflows to deprovision users if they're not using their license or have left your organization, but have some app users that should not be deprovisioned automatically.

Protecting individual app users

To protect a user of a particular app from being deprovisioned for that app:
  1. 1.
    From the Applications list, open the relevant app.
  2. 2.
    Open the Users tab. The app users are listed.
  3. 3.
    Click the context menu on a user row, or use the checkboxes to select multiple users and then expand the list context menu.
  4. 4.
    Click Protect user(s). The users are protected from automatic deprovisioning for that app.
Protecting multiple users from deprovisioning for a particular app.
To remove protection, open the context menu again and select Unprotect user(s).

Protecting a team

To protect all members of a particular team from deprovisioning for any apps:
  1. 1.
    Expand the Admin menu and select Settings > Applications.
  2. 2.
    Select Teams protected from deprovisioning. Any teams that have been protected are listed.
  3. 3.
    Click the field to expand the list and then select the teams you want to protect. All members of the team are protected from automatic deprovisioning for any apps. Selecting a parent team will protect all members of that team and any child teams.
Protecting all members of a team from deprovisioning from any apps.
To remove protection, remove the team from the list of Teams protected from deprovisioning.

Deprovisioning protected users

If you attempt to deprovision a protected user from the app list manually, a warning is displayed. Select a reason and click Suspend / Deactivate / Delete (as appropriate) to ignore the warning and revoke the user's access to the app.
Deprovisioning a protected user from the App Users page.
If a protected user is the subject of a deprovisioning workflow, when the workflow run for that user reaches a deprovisioning step for a relevant app, the run is paused with the status "Needs input". The deprovisioning step must be approved by a Trelica admin user before the workflow run can continue.
To check for workflow runs that require input and to approve or cancel deprovisioning steps:
  1. 1.
    Open Admin > Workflows. The list of workflows is displayed.
  2. 2.
    Click Status and filter the list by Needs input. Workflows with one or more runs requiring input are listed.
  3. 3.
    Identify the relevant deprovisioning workflow and click the number in the Runs column to view a list of the workflow runs requiring input.
  4. 4.
    Click the workflow subject to open the individual run page and review the details.
  5. 5.
    Select the relevant workflow step and choose whether to unprotect the user or skip the deprovisioning step for that app and move on to the next step of the workflow.
For more information, see Managing workflow runs.