Skip to content

Suspend or reactivate a user

Change the status of a person's membership in your tenant: suspend it to stop them signing in here, or reactivate it to let them back in. The membership's status is the one detail of a user you change from your tenant.

A person's name, email, password and authenticators belong to their account, which serves every organization they belong to. Nobody changes them from your tenant.

Who can do it

A tenant administrator or a tenant access administrator, or a platform super administrator working inside your tenant. The console offers Suspend membership and Reactivate membership only to a person who holds the permission to update users.

You can only change someone whose current permissions in your tenant you cover: a tenant access administrator cannot suspend a tenant administrator. You cannot change your own membership. On a SaaS deployment, a platform operator working inside your tenant under a support-access session cannot change a membership's status.

Before you start

  • The membership must have been accepted. A PENDING membership becomes active only when the person accepts their invitation, so it offers neither action.
  • To suspend, have a reason ready. It is required and recorded in the audit trail.

Steps

  1. Open Users in the sidebar.
  2. On the person's row, select the eye icon (View).
  3. On the Overview tab, under Membership in this tenant, select Suspend membership or Reactivate membership.
  4. To suspend, type the reason under Why is this membership being suspended?. Reactivating asks for no reason.
  5. Confirm with Suspend membership or Reactivate membership.

What you see when it worked

The console says Membership suspended. The person can no longer sign in to this tenant. or Membership reactivated, and the person's status reads SUSPENDED or ACTIVE.

Suspending ends the person's sessions in your tenant and keeps their roles. Their access to other organizations is untouched. Reactivating lets them sign in again with the roles the membership holds.

If it fails

The console shows The membership was not changed, with the reason:

Reason Cause What to do
The reason is missing or too long A suspension needs a reason within the size limit Type a shorter reason
A refusal naming the permissions you lack (scope-subset-violation) The person holds permissions in your tenant that you do not Ask an administrator who holds those permissions
A refusal that you cannot change your own membership You opened your own account Ask another administrator
A conflict Another change reached the membership first, for example the invitation was cancelled Close the sheet, open the person again and retry
The change is recorded as a request awaiting approval Your tenant requires quorum approval for this change The status changes when the request is approved

Without the console

Surface How
API PATCH /api/v3/admin/tenants/{tenantId}/users/{userId} (operation updateHumanUser) with status SUSPENDED and a reason, or status ACTIVE

The key management CLI and the admin SDK have no command or method for this task.