Home > Identity and access > Audit user lifecycle
Audit user lifecycle
Last updated: 2026-11-03Cadence: Weekly
Subscription model: All
Roles: Tenant Admin (TA)
Last verified: 2026-05
| Initial | Recurring | |
|---|---|---|
| Estimated time | 30 min | 10 min |
Benefits:
- Detects rogue or orphaned admin accounts after staff changes
- Confirms IdP-driven group changes are reflected in role assignments
- Maintains target of two Tenant Admins for IdP-recovery resilience
Goal
Weekly review of users added, leavers, role changes, and any auto-assigned roles keeps the tenant aligned with HR/IdP changes. Qlik requires at least one Tenant Admin at all times (you can't remove the role from yourself) and recommends keeping at least two so that if one Tenant Admin leaves the company, the other can continue to administer the tenant and serve as a recovery path.
Permission model reminder. Ownership transfer and role reassignment depend on all three of Qlik's permission layers: entitlement, security role, and space role. See Glossary → Identity, access, and security for the full model.
Tasks
| Task | TA | AA | DA | AuA |
|---|---|---|---|---|
| Audit new users added in the last 7 days (the All users list under Manage users) | ✓ | |||
| Reconcile leavers / movers from your IdP groups against role assignments | ✓ | |||
| Review changes to Tenant Admin assignments (target: keep at least two TAs at all times per Qlik recommendation) | ✓ | |||
| Review Permissions tab for newly created custom roles and Auto-assign toggles | ✓ | |||
| Before deleting a leaver's user record, transfer ownership of apps, datasets, scripts, data connections, and any business-critical automations (see gotchas: private sheets can't be reassigned, automations are deleted with the user) | ✓ |
Read before acting—gotchas
- Orphaned apps can still be reassigned post-deletion via the admin console (Content > Apps > filter by
Deleted User
> Change Owner). (community) - Private sheets inside an app can't be reassigned at all—capture or recreate them before the owner is deleted.
- Automations are strictly personal: they are deleted with the user with no admin transfer path. Recreate any business-critical automations under a service or shared account before deleting the user.
References
- Assigning security roles and custom roles (user-based)
- Assigning security roles and custom roles (capacity-based)
- Auditing user roles and access
- Service Account Owner and Tenant Admin FAQ
- Can the owner of orphaned apps be changed (community)
Tags: #weekly #identity_and_access #users #roles #idp