Warning Message "Removing the tenant admin role from this user may make it impossible to recover the tenant." when removing Tenant Admin role

[Akemi_F]

Removing the Tenant Admin role prompts this error:

User (NAME) created the tenant. Removing the tenant admin role from this user may make it impossible to recover the tenant.

Note: This warning message appears when:

• Disabling the User who created the tenant
• Deleting the User who created the tenant

Resolution

Scenario 1: User is the owner of the tenant.

• Tenant Admin role should not be removed from the current Tenant Owner. Please do NOT remove it. 
• If you need to change the Service Account Owner (SAO), log a ticket to Support.

Scenario 2: SAO is changed from the original creator of the tenant to the new SAO. Tenant Admin role is given to new SAO. Now you are trying to remove the previous SAO's Tenant Admin role. 

1: If you are using Qlik Cloud Service, please confirm the below: 

1. New SAO has logged in the tenant after the tenant ownership change is completed. 
2. Make sure to check if the new owner can log in to the recovery link https://<tenant name>.<region>.qlikcloud.com/login/recover
3. After accessing the recovery link, check if the new SAO can navigate to the Management Console.
   • If Yes: Ignore the Warning message and proceed.
   • If No: Can the current user seeing the Warning dialogue add the Tenant Admin role to the New SAO?
     • If Yes: Can that new SAO, via the recovery link, now navigate to the Management Console?
       •  If Yes: ignore the Warning message and proceed.
     • If No: 
       • log a ticket to Support.

2: If you are using your own IDP (BYOID license attribute is enabled)  

New SAO was invited to the tenant and given Tenant Admin role, and logged into the tenant at least once BEFORE your own IDP is enabled?

If YES, please confirm below: 

1. New SAO has logged in the tenant after the tenant ownership change is completed. 
2. Make sure to check if the new SAO can log in to the recovery link https://<tenant name>.<region>.qlikcloud.com/login/recover
3. After accessing the recovery link, check if the new SAO can navigate to the Management Console.
   • If Yes: ignore the Warning message and proceed.

If No: do NOT proceed and log a ticket to Support.

Note: Users who logged into the tenant only via the BYOIDP configuration cannot recover a tenant even if they have the tenant admin role. 

Related Content 

• User Management in Qlik Sense Business and Qlik Sense Enterprise SaaS
• Known limitation in Qlik Cloud Services: Account Owner should not be removed as tenant admin