Long-unused accounts are a security risk - they typically belong to people who no longer work for the company or have stopped cooperating with it. Automatic blocking finds and blocks such accounts without the administrator having to look them up manually. This feature is disabled by default.
Inactivity threshold
After how many days without sign-in the account is blocked. Default is 90 days.
Warning lead time
How many days before blocking the user receives a warning e-mail. Default is 7 days.
You will find the settings in System settings, tab Main, box Automatic blocking of inactive accounts.
Once a day at night, the system goes through all active accounts and determines when each of them was last active. Inactivity is measured from the latest of these moments:
- last sign-in,
- account creation (for accounts that have never signed in),
- last manual unblock by an administrator.
1. Warning
When less than the configured lead time remains until blocking, the user receives a warning e-mail asking them to sign in. The warning is sent only once per inactivity period.
2. Signing in stops the countdown
As soon as the user signs in, inactivity starts counting again from zero and the account is not blocked.
3. Blocking
When the inactivity threshold is reached, the system sets access denied on the account. The user receives an informational e-mail and administrators receive a summary of all accounts blocked during the nightly run.
Example (default settings: threshold 90 days, warning 7 days in advance):
- The user last signed in on 1 March
- Around 23 May they receive a warning that their account will be blocked in 7 days
- If they sign in before then, the countdown starts again from the sign-in date
- If they do not sign in, the account is blocked around 30 May
What counts as a sign-in: signing in with username and password or via SSO. Using the application in a browser where the user stays permanently signed in does not count, nor does signing in with a password-less link from an e-mail. A user who only uses the application this way may therefore receive a warning or even be blocked - signing in with a password once is enough.
Automatically block inactive accounts
Turns the whole feature on or off. Turning it off does not affect accounts that have already been blocked - they need to be unblocked manually.
Inactivity threshold (days)
Number of days without sign-in after which the account is blocked. Default is 90 days, allowed range 2-3650 days.
Warning lead time (days)
How many days before blocking the user receives a warning e-mail. Default is 7 days. The lead time must be shorter than the inactivity threshold - if it is equal or longer, no warning is sent and accounts are blocked without prior notice.
Before turning it on for the first time, check in the user list who has not signed in for a long time. The very first nightly run blocks all accounts that have already exceeded the inactivity threshold - without a warning, because there is no time left for one.
System administrators
Users with the System settings permission. This ensures there is always someone in the system who can unblock blocked accounts.
Users signing in via SSO
Their accounts are managed by the company identity provider, which handles employee departures itself.
API users and system accounts
Integration accounts and internal system accounts that do not normally sign in to the application.
Warning to the user
Subject "Your account will be blocked for inactivity", text "Your account will be blocked in 7 day(s) due to inactivity. Please sign in to keep it active."
Blocking notice to the user
Subject "Your account has been blocked for inactivity", text "Your account has been blocked due to inactivity. Please contact your administrator."
Summary to administrators
Subject "Summary: accounts blocked for inactivity" with a list of the blocked users' e-mails. It is sent to all users with the System settings permission, and only after a nightly run in which at least one account was blocked.
E-mails are sent in the recipient's language. A user without an e-mail address receives no notification, but their account is blocked anyway.
When trying to sign in, the same message is shown as for any other access denial: "Your account has been deactivated". Signing in is not possible until an administrator unblocks the account.
User list
Automatically blocked accounts have their own icon (user with a clock) in the account state column, different from a manual access denial. Hovering over it shows the text "Automatically blocked for inactivity" with the date and time of blocking.
User detail
A warning is shown at the top: "Account is blocked — Automatically blocked for inactivity (date and time)". The block is also recorded in the audit log as a user update made by the system.
A blocked account is unblocked by an administrator on the user detail: uncheck Deny access and save. This also:
- restarts the inactivity count from the moment of unblocking - so the account will not be blocked again before the full threshold has elapsed,
- removes any temporary lock after failed sign-in attempts.
Tip: If the unblocked user does not start using the application again, they will be blocked again once the threshold elapses. Accounts that nobody needs any more are better deleted straight away.