Inactive account policy¶

The inactive account policy manages the lifecycle of inactive user accounts in an organization. A background job reviews last activity for each user and, when an account exceeds the periods you configure, disables the account or marks it for deletion. System administrators set separate periods for regular users and for organization and system administrators, plus a grace period that applies after an administrator re-enables a disabled account.

The policy reduces standing access from unused accounts and supports inactivity requirements in environments such as FedRAMP. Permanent deletion of a marked account is always a manual action; DataRobot does not delete accounts automatically.

Lifecycle stages¶

Each organization can define two inactivity windows for regular users and two for administrators, plus a reactivation grace period.

The following table describes each stage.

%%{init: {"flowchart": {"curve": "linear"}}}%%
flowchart TB
    A["Active account"] -->|"Inactivity reaches<br/>disabling period"| B["Disabled"]
    B -->|"Administrator re-enables account"| C["Grace period"]
    B -->|"Inactivity reaches<br/>marked-for-deletion period"| D["Marked for deletion"]
    D -->|"Administrator deletes account"| E["Permanently deleted"]

Measures of activity¶

DataRobot records last activity at the authentication layer for UI and API requests, including requests that authenticate with an API key. Activity is stored as a date, not a timestamp, and is updated at most once per calendar day per user.

When you enable the policy for an organization, DataRobot first reconciles last activity for every user in that organization, then continues to record activity going forward. A background job then reviews those dates against the organization's periods and disables accounts or marks them for deletion.

Configure the inactive account policy¶

System administrators configure the lifecycle on the organization profile. Each organization has its own settings.

To configure the inactive account policy:

1. Click Admin settings > Organizations.

2. Select the organization and then click the Inactive account policy tab.

   

3. Turn on the toggle to enable configuring the inactive account policy for the organization. When you enable it, DataRobot reconciles last activity for every member of the organization.

4. Set the inactivity periods and the reactivation grace period described in the following table. Note that if you set both disabling and marking for deletion for an account type, the marked-for-deletion period must be greater than the disabling period.

   

   Setting	Account type	Description
   Disable after	User	The number of days of inactivity after which DataRobot disables a user account. This value must be greater than the web UI session lifetime, converted to days.
   Mark for deletion after	User	The number of days of inactivity after which DataRobot marks a user account for deletion. This value must be greater than the Disable after value for user accounts.
   Disable after	Administrator	The number of days of inactivity after which DataRobot disables an organization or system administrator account. This value must be greater than the Disable after value for user accounts, so that administrator accounts remain active longer.
   Mark for deletion after	Administrator	The number of days of inactivity after which DataRobot marks an organization or system administrator account for deletion. This value must be greater than the Disable after value for administrator accounts.
   Reactivation period	User and Administrator	The number of days a re-enabled account has to sign in before DataRobot disables it again. The default is seven days.

The example above shows a configuration that disables regular users after 90 days and marks them for deletion after 180 days, with longer windows for administrators:

With a 14-day grace period, a user whose administrator re-enables a disabled account must authenticate within 14 days or the account is disabled again.

View account status¶

Open Admin settings > Users to see each account's status in the users table. The same status appears on the user profile.

Possible statuses are described in the following table:

Re-enable a disabled account¶

To restore access for a disabled account that is not marked for deletion:

1. Click Admin settings in the top navigation bar and select Users.
2. Open the user profile.
3. Click Enable User.

The reactivation grace period starts when you re-enable the account. The user must sign in or authenticate to the API before that period ends. If they do, last activity updates and the account remains active. If they do not, the background job disables the account again.

Re-enabling an account does not reset the marked-for-deletion clock by itself. If inactivity continues and reaches the marked-for-deletion period, the job marks the account for deletion.

Permanently delete an account¶

You can permanently delete an account after it is marked for deletion or if the account has a disabled status. DataRobot does not permanently delete accounts as part of the policy.

1. Click Admin settings in the top navigation bar and select Users.
2. Open the profile of the user that shows the Marked for deletion status.
3. Delete the account, then confirm the deletion.

Permanent deletion cannot be undone in the DataRobot UI or API. Reassign deployments, applications, jobs, and workloads to a service account before you delete the user.

Service accounts¶

Authenticated API requests count as activity, so a service account that is used within the disabling period stays active. An unused service account is disabled and, if inactivity continues, marked for deletion like any other user.

Before you enable the policy, identify service accounts in the organization, confirm they authenticate often enough to stay under the disabling period, and keep them out of manual offboarding. After an account is marked for deletion, you cannot re-enable it from the UI.

Next steps¶

To learn more about user accounts, visit the following pages.

• Manage user accounts
• Deactivate user accounts
• Manage organizations
• SCIM provisioning