About UserDisableAction\u2019s default settings:<\/p>\n\n\n\n

\n
• For new installs of the Import agent, the default setting for this option is suspend<\/kbd>. <\/li>\n\n\n\n
• An upgrade of the Import agent retains the UserDisableAction setting.<\/li>\n\n\n\n
• An upgrade of the Import agent with a value for UserDissociateAction will have UserDisableAction set to the same value. <\/li>\n\n\n\n
• An upgrade of the Import agent without a value for userDissociateAction will have UserDisableAction set to remove<\/kbd>. <\/li>\n\n\n\n
• The value for userDisableAction takes precedence over the value for UserDissociateAction.<\/li>\n<\/ul>\n\n\n\n

  Suspend Actions on the Sync Agent<\/strong><\/p>\n\n\n\n

  \n
  • When an active JumpCloud user with a corresponding AD user is suspended in JumpCloud, the user is disabled in AD. The JumpCloud user remains suspended.<\/li>\n\n\n\n
  • When an active JumpCloud user without a corresponding AD user is suspended, the user is created and then disabled in AD. The user remains suspended in JumpCloud.<\/li>\n<\/ul>\n\n\n\n

    Suspend Actions on the Import Agent<\/strong><\/p>\n\n\n\n

    \n
    • When the AD Import agent has no UserDisableAction property, or has UserDisableAction set to suspend<\/kbd>,<\/em> and a user is disabled in AD:\n
      \n
      • If a user doesn\u2019t exist in JumpCloud, a user is created in JumpCloud according to current AD Import rules.<\/li>\n\n\n\n
      • If a user exists in JumpCloud: unsuspend the existing or created user if the AD user isn\u2019t disabled.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
      • When the AD Import agent has UserDisableAction set to unbind<\/kbd> and a user is disabled in AD:\n
        \n
        • If a user doesn\u2019t exist, or isn\u2019t owned by this AD Import agent, a new user isn\u2019t created in JumpCloud.<\/li>\n\n\n\n
        • If a user owned by this AD Import agent exists in JumpCloud, externally managed fields are cleared.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
        • When the AD Import agent has UserDisableAction set to remove<\/kbd> and a user is disabled in AD:\n
          \n
          • If a user doesn\u2019t exist in JumpCloud, or isn\u2019t owned by this AD Import agent, a user isn\u2019t created in JumpCloud.<\/li>\n\n\n\n
          • If a user owned by this AD Import agent exists in JumpCloud, the user is deleted from JumpCloud.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n

            The following tables describe the actions taken in AD and JumpCloud for existing and new users for UserDisableAction settings.<\/p>\n\n\n\n

            \n

            Suspend: Existing User<\/h3>\n

            \n \n\n \n \n \n \n \n \n \n

            \n UserDisableAction Setting <\/th>\n	\n Action in AD <\/th>\n	\n Action in JumpCloud <\/th>\n <\/tr>\n
            \n suspend <\/td>\n	\n Disabled <\/td>\n	\n Suspend <\/td>\n <\/tr>\n
            \n Enabled <\/td>\n	\n Not suspended \/ active <\/td>\n <\/tr>\n
            \n remove <\/td>\n	\n Disabled <\/td>\n	\n Deleted from JumpCloud <\/td>\n <\/tr>\n
            \n Enabled <\/td>\n	\n N\/A <\/td>\n <\/tr>\n
            \n unbind <\/td>\n	\n Disabled <\/td>\n	\n Externally managed fields are cleared, user is removed from groups <\/td>\n <\/tr>\n
            \n Enabled <\/td>\n	\n N\/A <\/td>\n <\/tr>\n <\/table>\n<\/div><\/div>\n\n\n\n \n Suspend: New User<\/h3>\n \n \n\n \n \n \n \n \n \n \n \n UserDisableAction Setting <\/th>\n \n Action in AD <\/th>\n \n Action in JumpCloud <\/th>\n <\/tr>\n \n suspend <\/td>\n \n Disabled <\/td>\n \n Suspended <\/td>\n <\/tr>\n \n Enabled <\/td>\n \n Not suspended \/ active <\/td>\n <\/tr>\n \n remove <\/td>\n \n Disabled <\/td>\n \n N\/A <\/td>\n <\/tr>\n \n Enabled <\/td>\n \n User is created <\/td>\n <\/tr>\n \n unbind <\/td>\n \n Disabled <\/td>\n \n N\/A <\/td>\n <\/tr>\n \n Enabled <\/td>\n \n User is created <\/td>\n <\/tr>\n <\/table>\n<\/div><\/div>\n\n\n\n Disable Scenarios<\/strong><\/h3>\n\n\n\n The following scenarios describe the UserDisableAction setting you should apply to achieve a desired behavior when a user is disabled in AD.<\/p>\n\n\n\n Import Only<\/p>\n\n\n\n \n If you want disabled users to be retained and suspended in JumpCloud, set UserDisableAction to suspend<\/kbd>.<\/li>\n\n\n\n If you want disabled users to be removed from JumpCloud and all associated AD groups and external directories, set UserDisableAction to remove<\/kbd>.<\/li>\n\n\n\n If you want disabled users to be removed from the domain in JumpCloud and all associated AD groups, set UserDisableAction to unbind<\/kbd>.<\/li>\n<\/ul>\n\n\n\n Suspend Scenarios<\/strong><\/h3>\n\n\n\n The following scenarios describe the UserDisableAction setting you should apply to achieve a desired behavior when a user is suspended in JumpCloud.<\/p>\n\n\n\n Sync and Import Agents<\/p>\n\n\n\n \n If you want users that are suspended in JumpCloud to remain in JumpCloud with all associated group and directory associations, set UserDisableAction to suspend<\/kbd>.<\/li>\n\n\n\n If you want users that are suspended in JumpCloud to be removed from JumpCloud and all associated groups and external directories, set UserDisableAction to remove<\/kbd>.<\/li>\n\n\n\n If you want users that are suspended in JumpCloud to be removed from all associated groups and external directories, but remain in JumpCloud, set UserDisableAction to unbind<\/kbd>.<\/li>\n<\/ul>\n\n\n\n UserExpireAction<\/strong><\/h2>\n\n\n\n This setting controls the behavior in JumpCloud when an AD user\u2019s password expires. <\/p>\n\n\n\n UserExpireAction can be set to the following:<\/p>\n\n\n\n \n expire<\/kbd>: when an AD user\u2019s password expires, the corresponding JumpCloud user\u2019s password is expired.<\/li>\n\n\n\n maintain<\/kbd>: when an AD user\u2019s password expires, the corresponding JumpCloud user\u2019s password remains active.<\/li>\n<\/ul>\n\n\n\n About UserExpireAction\u2019s default settings:<\/p>\n\n\n\n \n For new installs of the Import agent, the default setting for this option is expire<\/kbd>.<\/li>\n\n\n\n An upgrade of the Import agent retains the UserExpireAction setting, if it is set.<\/li>\n\n\n\n An update of the Import agent without a setting for UserExpireAction sets this option to maintain<\/kbd>.<\/li>\n<\/ul>\n\n\n\n Expire actions on the Sync Agent<\/p>\n\n\n\n \n If a user\u2019s password expires in JumpCloud, their password expires in AD.<\/li>\n<\/ul>\n\n\n\n Expire Actions on the Import Agent<\/p>\n\n\n\n \n When the Import agent has no specified setting for UserExpireAction, or has UserExpireAction set to expire<\/kbd>:\n \n An existing JumpCloud user with an expired password in AD immediately expires in JumpCloud.<\/li>\n\n\n\n JumpCloud\u2019s external_password_expiration_date<\/kbd> field is set to the value in AD.<\/li>\n\n\n\n If a user doesn\u2019t exist in JumpCloud and isn\u2019t owned by the AD Import agent, a new user is created in JumpCloud and then expires.<\/li>\n<\/ul>\n<\/li>\n\n\n\n When the AD Import agent has UserExpireAction set to maintain<\/kbd>:\n \n Nothing happens in JumpCloud; the user\u2019s password stays active.<\/li>\n\n\n\n JumpCloud\u2019s external_password_expiration_date<\/kbd> field is cleared.<\/li>\n\n\n\n If a user doesn\u2019t exist in JumpCloud and isn\u2019t owned by the AD Import agent, a new user is created in JumpCloud.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":" Configuration options are available after you install the Active Directory Integration (ADI) Import Agent. These configuration options are in a […]<\/p>\n","protected":false},"author":205,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2904,2855,2954],"support_tag":[],"coauthors":[2839,3011],"acf":[],"yoast_head":"\n