Is there a way to programmatically remove a user from all Multipass groups?
What’s the recommended ‘offboarding’ flow for Foundry instances that are managed through Azure SSO?
– More info –
Our deployment is integrated so that users can only log into Foundry through Azure SSO. A user’s Azure AD/Entra groups are automatically detected during login, and these Azure groups are used to automatically place the user into the correct Multipass groups in Foundry.
We are struggling with a user offboarding flow. Since there’s no way to deactivate a user anymore in Foundry (only delete is supported), when an employee leaves the company their user will persist in Palantir as ACTIVE and they will still be a member of various Multipass groups. This will make any reporting based on these groups out-of-date, unless someone manually goes through the process of removing them
My assumptions are:
-
There’s no way to “deactivate” a user. You can only “delete” users from Palantir
-
There’s no way to actively ping our Azure active directory on a regular basis to pull a user’s AD groups and permissions.
Of course, if we internally offboard someone from CRB and remove them from any AD groups, they won’t be able to log into Palantir anymore. They would be blocked on login. But until they try to log in again, their user in Palantir would still exist and appear as though they were still part of any permission groups.