Deactivation Authorizations are records created to indicate the implicit or explicit consent to deactivate a Salesforce User.
- A Deactivation Authorization record is created when an active Salesforce User is asked whether they are willing to be deactivated to allow another Salesforce User to be activated.
- A Deactivation Authorization record can also be created automatically if the Automatic Deactivation feature is configured on the Salesforce User Pool used to activate a Salesforce User.
Deactivation Authorization Process
When a valid Activation Request is made by an inactive Salesforce User and there are no available Salesforce licenses to allocate, Skuser will ask currently active users that are Pool Members in the same User Pool as the requesting user if they are willing to be deactivated – i.e. the active users are asked to offer a Deactivation Authorization.
There are some circumstances where active users in the same User Pool are not asked to offer a Deactivation Authorization.
- If an active Salesforce User has Do Not Deactivate set on their User record, they will not be asked to offer a Deactivation Authorization.
- If an active Salesforce User is a Pool Member in the same User Pool as the requesting inactive user, but their Allocation Status is ‘Do Not Allocate’, they will not be asked to offer a Deactivation Authorization.
- If an active Salesforce User is not correctly licensed to use Skuser, they will not be asked to offer a Deactivation Authorization.
When an active Salesforce User is asked if they are willing to be deactivated, the Deactivation Risk on their associated Pool Member record is lifted from Low to Medium.
When a Pool Member’s Deactivation Risk is Medium, the associated Salesforce User must respond to the Deactivation Authorization request with in a defined time period, set on the User Pool record.
During this time, the Salesforce User may or may not take active steps related to the request.
- If the active Salesforce User explicitly declines the Deactivation Authorization request, then the Deactivation Risk of their Pool Member record is lowered from Medium to Low. No Deactivation Authorization record will be created and the user will not be deactivated.
- If the active Salesforce User explicitly grants the authorization, then their Deactivation Risk is lifted from Medium to High and a time-limited ‘Explicit’ Deactivation Authorization record is created and associated with their Pool Member record.
- If the active Salesforce User does not respond with the specified time, then their Deactivation Risk is lifted from Medium to High and a time-limited ‘Implicit’ Deactivation Authorization record is created and associated with their Pool Member record.
If a valid Activation Request can be matched up with a Deactivation Authorization before the time-limit on the Deactivation Authorization record, then the inactive Salesforce User making the Activation Request will be activated and the active Salesforce User granting the Deactivation Authorization will be deactivated.
When a Deactivation Authorization’s time limit is reached, it cannot be used to match up with an Activation Request and the associated Pool Member’s Deactivation Risk is changed from High to Low.