Skip to main content
Announcements
Have questions about Qlik Connect? Join us live on April 10th, at 11 AM ET: SIGN UP NOW
cancel
Showing results for 
Search instead for 
Did you mean: 
mwallman
Creator III
Creator III

What is the best way to de-allocate licences for users that removed from an AD group?

Hello all,

How do you de-allocate licenses automatically for users that are removed from an AD group?

E.g. We have 7,000 users and people leave or change status all the time yet I am still finding that a Qlik Sense license has been allocated to a user that is now "Removed externally".

What is the best way to manage licenses for these users?

2 Solutions

Accepted Solutions
s_kabir_rab
Partner Ambassador
Partner Ambassador

Just found Levi's original post on similar issue.

https://community.qlik.com/t5/Qlik-Sense-Integration/Qlik-Sense-License-Management-through-API/m-p/1...
Kabir
Please do not forget to the mark the post if you find it useful or provides you the solutions 🙂

View solution in original post

jlongoria
Creator
Creator

We defined our directory connector criteria such that only users who are members of specific AD groups are retrieved. Some of these users are auto assigned licenses using license assignment rules based on group membership. To your de-allocation question, users that are removed from the AD groups defined in the directory connector are marked as "removed externally". It is then possible to use that status to identify and take action on license assignment. If you later re-add the user to the AD group, the "removed externally" flag is reset and a license is allocated automatically via the assignment rules (if de-allocation hasn't happened yet, the user never knows). 🙂 So far, this approach seems to provide what we need for auto license assignment and de-allocation. It's early and we may find some gotchas later, though. If anyone knows of any given what I've described here, please let me know! 😉

View solution in original post

5 Replies
s_kabir_rab
Partner Ambassador
Partner Ambassador

You can use QRS API to automate this process. There are few options. Easiest one would be using the  Qlik Sense CLI (PowerShell). You can also use a Qlik Sense app and REST connector to perform this or built tool that can make REST calls.

To assign or remove you can use the following QRS endpoint -

  • /qrs/license/useraccesstype

Make a POST call to that  API with ID = the user ID you are updating. You can use a user list/table to drive your allocation.

If the user never used Sense then you can perform  a Delete operating on the following API - 

  • /qrs/license/useraccesstype/{ID}

Theres a github repo with some example from @Levi_Turner which is really handy. 

Hope this helps.

 

Kabir
Please do not forget to the mark the post if you find it useful or provides you the solutions 🙂
s_kabir_rab
Partner Ambassador
Partner Ambassador

Just found Levi's original post on similar issue.

https://community.qlik.com/t5/Qlik-Sense-Integration/Qlik-Sense-License-Management-through-API/m-p/1...
Kabir
Please do not forget to the mark the post if you find it useful or provides you the solutions 🙂
jlongoria
Creator
Creator

We defined our directory connector criteria such that only users who are members of specific AD groups are retrieved. Some of these users are auto assigned licenses using license assignment rules based on group membership. To your de-allocation question, users that are removed from the AD groups defined in the directory connector are marked as "removed externally". It is then possible to use that status to identify and take action on license assignment. If you later re-add the user to the AD group, the "removed externally" flag is reset and a license is allocated automatically via the assignment rules (if de-allocation hasn't happened yet, the user never knows). 🙂 So far, this approach seems to provide what we need for auto license assignment and de-allocation. It's early and we may find some gotchas later, though. If anyone knows of any given what I've described here, please let me know! 😉

ryanplkam
Partner - Contributor III
Partner - Contributor III

Hi, can you please explain how you use the "removed externally" flag to de-allocate licenses? I thought access rules only apply for granting licenses but not revoking?

Thanks

AmirTaub
Contributor II
Contributor II

Hi

Did it work?

Can you send a picture how you wrote that rule?

Thanks