how users are deprovisioned from Splunk Cloud

[sc_admin11]

Considering our current setup i.e authentication and Authorization integrated with SAML, how do we
1. mark an user inactive

2. what do we do with his/her knowledge objects.

[_JP]

1.  Create and manage users with Splunk Web - Splunk Documentation

2.  Manage orphaned knowledge objects - Splunk Documentation

[richgalloway]

I just checked a Splunk Cloud stack and the only users with the delete option are local.  The SAML users do not have the Edit action, therefore no delete.

[richgalloway]

1. You can't.  Splunk doesn't know if a user is active or not - only that they pass authentication (or not).  A user never signing in is just a user who never signs in rather than an inactive/expired user.  You can, however, file a support request to have the user removed.

2. Assign the user's KOs to another user.  Go to Settings->All configurations and click the "Reassign Knowledge Objects" button.

[sc_admin11]

If we delete user without reassign KO to other user. Than what would happen with that KOs.

@richgalloway 

[richgalloway]

The KOs will remain, but will become "orphans" (owned by nobody).  They can be re-assigned to another user, however.

[sc_admin11]

Is there any search query from which we can get the inactive users? @richgalloway @_JP 

[richgalloway]

This query will tell you when each user last logged in.  It's up to you to decide which of them is "inactive".

| rest /services/authentication/users splunk_server=local | table title last_successful_login

[sc_admin11]

@richgalloway in table i got empty column for 

last_successful_login