[Home](https://help.qlik.com/en-US/cloud-admin-playbook/Content/home.htm) > [Identity and access](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access.htm) > Audit user lifecycle

# Audit user lifecycle

**Cadence:** Weekly

**Subscription model:** All

**Roles:** Tenant Admin (TA)

**Last verified:** 2026-05

|  | Initial | Recurring |
| --- | --- | --- |
| **Estimated time** | 30 min | 10 min |

**Benefits:**

* Detects rogue or orphaned admin accounts after staff changes
* Confirms IdP-driven group changes are reflected in role assignments
* Maintains target of two Tenant Admins for IdP-recovery resilience

***

## Goal

Weekly review of users added, leavers, role changes, and any auto-assigned roles keeps the tenant aligned with HR/IdP changes. Qlik **requires at least one Tenant Admin at all times** (you can't remove the role from yourself) and **recommends keeping at least two** so that if one Tenant Admin leaves the company, the other can continue to administer the tenant and serve as a recovery path.

> **Permission model reminder.** Ownership transfer and role reassignment depend on all three of Qlik's permission layers: entitlement, security role, and space role. See [Glossary → Identity, access, and security](https://help.qlik.com/en-US/cloud-admin-playbook/Content/glossary.htm#identity-access-and-security) for the full model.

## Tasks

| Task | TA | AA | DA | AuA |
| --- | --- | --- | --- | --- |
| Audit **new users** added in the last 7 days (the **All users** list under Manage users) | ✓ |  |  |  |
| Reconcile leavers / movers from your IdP groups against role assignments | ✓ |  |  |  |
| Review changes to **Tenant Admin** assignments (target: keep at least two TAs at all times per Qlik recommendation) | ✓ |  |  |  |
| Review **Permissions** tab for newly created custom roles and Auto-assign toggles | ✓ |  |  |  |
| Before deleting a leaver's user record, transfer ownership of apps, datasets, scripts, data connections, and any business-critical automations (see gotchas: *private sheets can't be reassigned*, *automations are deleted with the user*) | ✓ |  |  |  |

## Read before acting—gotchas

* **Orphaned apps can still be reassigned post-deletion** via the admin console (Content > Apps > filter by
  > Deleted User

  > Change Owner). ([community](https://community.qlik.com/t5/Official-Support-Articles/Qlik-Cloud-Analytics-Can-the-owner-of-orphaned-Apps-be-changed/ta-p/2484034))
* **Private sheets inside an app can't be reassigned at all**—capture or recreate them before the owner is deleted.
* **Automations are strictly personal**: they are deleted with the user with no admin transfer path. Recreate any business-critical automations under a service or shared account before deleting the user.

## References

* [Assigning security roles and custom roles (user-based)](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/SaaS-roles.htm)
* [Assigning security roles and custom roles (capacity-based)](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/SaaS-roles-capacity-model.htm)
* [Auditing user roles and access](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/permissions-auditing.htm)
* [Service Account Owner and Tenant Admin FAQ](https://community.qlik.com/t5/Official-Support-Articles/Qlik-Cloud-Services-Service-Account-Owner-and-Tenant-Admin-FAQ/ta-p/1799811)
* [Can the owner of orphaned apps be changed (community)](https://community.qlik.com/t5/Official-Support-Articles/Qlik-Cloud-Analytics-Can-the-owner-of-orphaned-Apps-be-changed/ta-p/2484034)

**Tags:** `#weekly` `#identity_and_access` `#users` `#roles` `#idp`