> For the complete documentation index, see [llms.txt](https://docs.oceanenterprise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/user-deactivation.md).

# User Deactivation

### Overview

Deactivation blocks authentication for a user while preserving the user record, its attributes and its group membership. Use deactivation instead of removal whenever the identity may need to be restored, or when audit records must retain a resolvable user.

For detail-oriented flow illustration, please consult [Sequence Flow](#sequence-flow).

### Procedure

1. Authenticate in Authentik Dashboard as `akadmin` , Administrator account which was created at [initial setup](/infrastructure/user-management-package/deployment-steps/post-installation-steps.md#set-the-authentik-server-administrator-account).
2. Navigate to **Directory → Users** and select the user.
3. Select **Deactivate User**.

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FyuC88Aw0fvgwm8eGHDLz%2FScreenshot%202026-09-08%20at%2003.15.17.png?alt=media&amp;token=6a624a15-f6df-4387-9679-fed92e8fb7d3" alt=""><figcaption></figcaption></figure>

3. Revoke the credentials already issued to the user. On the user detail page:

| Tab                      | Action                                                                                 |
| ------------------------ | -------------------------------------------------------------------------------------- |
| **Sessions**             | Delete the active Authentik sessions of the user                                       |
| **OAuth Refresh Tokens** | Delete the refresh tokens issued to the user                                           |
| **Explicit Consent**     | Delete the consents granted by the user, if the application must request consent again |

### Verification

Check if Active flag for specific user is set to **No** like in the screenshot belo&#x77;**.**

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2F6XbbtkeFU4mNBmc7asO1%2FScreenshot%202026-09-08%20at%2003.16.07.png?alt=media&amp;token=1ed191fc-8354-4f65-9099-f8d751d6d692" alt="" width="408"><figcaption></figcaption></figure>

### Notes

* Deactivation alone does not terminate access immediately. The provider issues access tokens with a validity of one hour and refresh tokens with a validity of 30 days. Access ends immediately only when the sessions and refresh tokens are revoked as described in step 4.
* **Federated users.** Deactivating the Operator shadow user prevents the user from accessing the OE Marketplace through the Operator, but it does **not** deactivate the account on the Participant Authentik. Conversely, deactivating the user on the Participant Authentik prevents new federated logins, but existing Operator sessions and refresh tokens remain valid until they are revoked. Deactivate on both sides, and revoke Operator sessions, when access must end immediately.
* To suspend all users of a Participant at once, disable the Participant OAuth Source instead of deactivating individual users. Navigate to **Directory → Federation and Social login**, select the Participant source, and disable it.

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FAzAyC6wyor6VK6m4LOgS%2FScreenshot%202026-09-08%20at%2003.21.22.png?alt=media&amp;token=ce733fc5-678f-4238-859a-ca57da808c17" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FGP9ddG3CpgzUHFG5zbbc%2FScreenshot%202026-09-08%20at%2003.20.55.png?alt=media&amp;token=8ff163fe-3380-4966-9758-67960783f755" alt=""><figcaption></figcaption></figure>

### Appendix

#### Sequence Flow

```mermaid
sequenceDiagram
    autonumber
    actor OA as Administrator
    participant UI as Authentik<br>Service
    participant PG as Authentik<br>Database
    actor U as Directory User

    OA->>UI: Selects the user
    OA->>UI: Edits the user and clear the active flag
    UI->>PG: Marks the user as inactive
    UI->>PG: Records the change event
    PG-->>UI: Users deactivated
    UI-->>OA: Users listed as inactive

    Note over OA,PG: Deactivation alone does not<br>end the sessions already established

    OA->>UI: Open the sessions of the user and delete them
    UI->>PG: Remove the sessions of the user
    OA->>UI: Open the issued tokens of the user and delete them
    UI->>PG: Remove the issued tokens of the user
    PG-->>UI: Sessions and tokens revoked

    U->>UI: Attempt to authenticate
    UI->>PG: Read the user record
    PG-->>UI: User is inactive
    UI-->>U: Authentication rejected

    Note over OA,PG: For federated users the account must<br>also be deactivated on the Participant,<br>otherwise only the access through the Operator is blocked
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/user-deactivation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.