The User Lifecycle Rules feature helps you manage inactive user accounts automatically. It improves security and reduces manual effort. If you regularly onboard and offboard users, this gives you greater control over how and when inactive users are disabled or deleted.

Customize Rules Based on Authentication and Activity

You can create rules based on the user's authentication method and their length of inactivity. For example, disable users who sign in with a password after 30 days of inactivity, allow SSO users up to 180 days, and set a 365-day limit for users authenticating with passwords and SSH keys. This flexibility helps align your deactivation policies with your security standards and the roles users play in your environment.

Automating user lifecycle management is useful in many situations. For instance, if contractors are given password-based access for short-term projects, you can automatically disable them once the project ends. For internal staff using SSO, a longer inactivity window may be appropriate. If you have service accounts or automation users authenticating with SSH keys, you may allow extended inactivity without disabling them. This level of control helps prevent accidental lockouts while maintaining strong security and governance.

Each rule defines the action to take on inactive users, the allowed inactivity period, and the authentication methods it applies to. Rules can also include or exclude folder admins and site administrators. When lifecycle rules are active, they override individual user-level settings such as Automatically disable this user if not logged in by this date and Access expiration date.

Affected users are disabled or deleted within 24 hours after reaching the specified inactivity threshold. For example, if a rule is configured to delete users after 90 days of inactivity, those users will be deleted sometime between the 90th and 91st day following their last activity.

If you want to bypass the User Lifecycle Rule for a particular user, edit the user's settings and enable the option Prevent this user from being disabled due to inactivity.

Automating user lifecycle management this way helps enforce consistent security policies, support compliance requirements, and streamline user offboarding. It reduces the risk of unused or forgotten accounts staying active in your system, and ensures your user base remains clean, current, and aligned with your access control practices.