Qlik Cloud Analytics: Are users indicated as inactive in the Administration Console if they are removed from a custom Identity Provider (IdP)?

[Albert_Candelario]

When using Qlik Cloud with a custom IdP and a user is removed from the IdP, will that change be propagated into Qlik Cloud? 

Resolution

The answer to the question depends on the IdP used and the if the provisioning has been enabled or not.

If the current IdP used does not support SCIM then the changes done on your IdP side will not be propagated into Qlik Cloud. So, the user will not be flagged as inactive or removed on your tenant.

If you are using Azure AD* and the provisioning has been enabled, then the changes will be propagated as explained in Provisioning users and groups using SCIM | Qlik Cloud Help.

SCIM provides a standardized way for IT systems to communicate and exchange user identity data. With SCIM, you can:

• Create a new user in one system and automatically provision the same user in another system.
• Update user information in one system and reflect that change in all other systems.
• Delete a user in one system and automatically deprovision the user in all other systems.

On Qlik Cloud, when users are deprovisioned via SCIM, those users are marked as Disabled:

Disabled users are not permitted to log in to Qlik Cloud:

After users are marked as Disabled, administrators can opt to delete those users. It is encouraged to reassign ownership of those user’s assets (apps, data connections, data-files).

Related Content 

Provisioning users and groups using SCIM - Qlik | Help
SCIM: System for Cross-domain Identity Management (simplecloud.info)
SCIM synchronization with Azure Active Directory - Microsoft Entra | Microsoft Learn

*SCIM connectors that work with Qlik Cloud (as of the date of creation of this article - 15th March 2023) :

• Qlik Cloud supports Microsoft Azure Active Directory (Azure AD).

Environment

Qlik Cloud