Qlik Community

Qlik Sense Deployment & Management

Discussion board where members learn more about Qlik Sense Installation, Deployment and Management.

Announcements
IMPORTANT: Upcoming LEF Database Maintenance, Oct. 3rd - SEE DETAILS
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Creator III
Creator III

What is the best way to de-allocate licences for users that removed from an AD group?

Hello all,

How do you de-allocate licenses automatically for users that are removed from an AD group?

E.g. We have 7,000 users and people leave or change status all the time yet I am still finding that a Qlik Sense license has been allocated to a user that is now "Removed externally".

What is the best way to manage licenses for these users?

4 Replies
Highlighted
Luminary
Luminary

You can use QRS API to automate this process. There are few options. Easiest one would be using the  Qlik Sense CLI (PowerShell). You can also use a Qlik Sense app and REST connector to perform this or built tool that can make REST calls.

To assign or remove you can use the following QRS endpoint -

  • /qrs/license/useraccesstype

Make a POST call to that  API with ID = the user ID you are updating. You can use a user list/table to drive your allocation.

If the user never used Sense then you can perform  a Delete operating on the following API - 

  • /qrs/license/useraccesstype/{ID}

Theres a github repo with some example from @Levi_Turner which is really handy. 

Hope this helps.

 

Kabir
Please do not forget to the mark the post if you find it useful or provides you the solutions 🙂
Highlighted
Luminary
Luminary

Just found Levi's original post on similar issue.

https://community.qlik.com/t5/Qlik-Sense-Integration/Qlik-Sense-License-Management-through-API/m-p/1...
Kabir
Please do not forget to the mark the post if you find it useful or provides you the solutions 🙂
Highlighted
Creator
Creator

We defined our directory connector criteria such that only users who are members of specific AD groups are retrieved. Some of these users are auto assigned licenses using license assignment rules based on group membership. To your de-allocation question, users that are removed from the AD groups defined in the directory connector are marked as "removed externally". It is then possible to use that status to identify and take action on license assignment. If you later re-add the user to the AD group, the "removed externally" flag is reset and a license is allocated automatically via the assignment rules (if de-allocation hasn't happened yet, the user never knows). 🙂 So far, this approach seems to provide what we need for auto license assignment and de-allocation. It's early and we may find some gotchas later, though. If anyone knows of any given what I've described here, please let me know! 😉

Highlighted
Partner
Partner

Hi, can you please explain how you use the "removed externally" flag to de-allocate licenses? I thought access rules only apply for granting licenses but not revoking?

Thanks