Service Account Owner in Qlik Saas has access to published app without license

[AG-gugelbisolutions]

Hi there, I recently dealt with some SAO related issues, essentially due to the fact that the IdP account is not active any more. The account was temporary activated again, but the only Professional license available was given to another user.  We noticed, though, that the newly activated account is still able to enter and consult the only published app !!

Is the SAO granted this kind of access by default?

Thanks.

P.S. 1 : tha SAO was the owner of the app but now it is not

P.S. 2 : dynamic allocation is not activated and the SAO is not listed in the user allocation menu

[Vinay_B]

Hi @AG-gugelbisolutions 

The service account owner will be able to log in to the tenant even without a license. By default, they will have a tenant admin role and can navigate within the management console. Also, if the IDP is active SAO can access the tenant using the recovery link. 

Please refer below:

• https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Introduction/service-acc...
• https://community.qlik.com/t5/Knowledge/Qlik-Cloud-Services-Service-Account-Owner-and-Tenant-Admin-F... 

If the old SAO is no longer needed, then transfer the ownership to the new user and then remove the old SAO from the tenant itself. 

I hope this helps!

[AG-gugelbisolutions]

Hi @Vinay_B , I perfectly understand this in the QMC, does it apply to the hub too?

[Albert_Candelario]

Hello @AG-gugelbisolutions ,

Sorry to ask an obvious question, but how to you know the user is indeed able to open that particular app and is not facing an error when trying so? Meaning, do you have evidences she/he can see in fact the data inside the app?

Juts trying to understand your issue better 🙂

Cheers,

Albert

[AG-gugelbisolutions]

Everyone who helps identifying the issue is very welcome!

We actually reset his credentials and activated his AD account, and we are able to navigate through the app sheets without any particular restriction.

It sounds so weird that there must be something specific to this account that makes it so powerful.

[Daniele_Purrone]

Hi @AG-gugelbisolutions ,

do you mean that the SAO has access to apps he shouldn't have access to?

[Albert_Candelario · Accepted solution]

Hello @AG-gugelbisolutions ,

What about Analyzer capacity (minutes)? Do you have minutes on your license and such user could be consuming minutes and hence able to navigate on such app, regardless of the fact no analyser/professional license is assigned to him.

Cheers,

Albert

[AG-gugelbisolutions]

Well, he is still included in Section Access, but he has no license!

[AG-gugelbisolutions]

To be honest, I'm not aware of it, but, if I remember correctly, no, there is not Analyzer Capacity; but it is worth a check as it would explain the behavior.

Thanks

[Albert_Candelario]

If you have access to the tenant console, please go to "User overview" section and then "overview" and check if you have it there as below:

Cheers,

Albert