OneLogin - Automating User Deactivation Using Effective Date and Attribute‑Based Mappings (4383200)

Organizations often need to automatically deactivate user accounts when a predefined effective date (such as the last working day) is reached. Without automation, administrators must manually track dates and disable accounts, which increases operational effort and the risk of delayed deactivation.

To automate user deactivation based on an effective date, implement the following steps:

1. Create a Custom User Field

   • Add a custom user attribute designed to store a date value (for example, Effective Date or Last Day).
   • Ensure the field is populated for users who require future deactivation.

2. Configure a User Mapping

   • Navigate to the user mapping configuration area.
   • Create a new mapping or update an existing one.
   • Define a condition such as:
     • If the effective date field is not empty (or meets organizational criteria).

3. Define Automation Actions

   • Configure the mapping action to suspend the user when the condition is met.
   • Optionally include additional actions to:
     • Remove role assignments.
     • Revoke application access.
     • Remove licenses or entitlements.

4. Apply and Test the Mapping

   • Save the mapping and test it against sample users.
   • Reapply mappings to ensure existing users are evaluated correctly.

5. Validate Deprovisioning Coverage

   • Review downstream provisioning to ensure applications and licenses are properly removed when the user is suspended.

This configuration allows the platform to automatically enforce deactivation policies without ongoing manual intervention.