When it's time to remove a user from your organization's Sumo Logic account, there are a few important steps to take before actually disabling or deleting that user. To save the settings for a user and temporarily prevent access, you can deactivate a user rather than deleting them. Disabled users can't log in to their Sumo Logic account, giving you time to replicate content.
Before you deactivate or delete a user
To safeguard content in your organization's Sumo Logic account perform the following tasks:
1. Transfer Account Owner (if necessary)
A user designated as Account Owner cannot be deleted. To transfer ownership, the account owner must do this on the Account page. See Changing the Account Owner.
2. Replicate the User's Content
Deleting a user changes the behavior of the following content
- Scheduled Views are stopped. Data is no longer indexed into Scheduled Views created by a user once the user is deleted, but the data itself is not deleted (and the name of the Scheduled View remains). Make sure to create new Scheduled Views using the same query as the user's Scheduled Views before deleting the user.
- Shared saved searches are unpublished. Save a copy of each saved search, then publish them from your account.
- Published Dashboards are unpublished. You can copy a Dashboard, then publish it from your account to replicate the content.
Deleting a user does not change the behavior of the following content
- Partitions. Data continues to be indexed into Partitions that the user set up.
- Unpublished Dashboards.
- Saved searches.
- Scheduled Searches. Email alerts associated with Scheduled Searches are automatically updated from the user who is deleted, to the email belonging to the admin who deletes the user.
3. Check for whitelisted IP addresses
Verify if the user has an IP address that should be removed under Administration > Security.
4. Check for access to any shared Access IDs and Keys
If a deleted user's Access IDs and Keys are used in automation tools like Chef or Puppet to register new Collectors, registrations will fail. Delete and recreate any Access IDs and Keys as necessary.