Problem description

Some users in the Druva inSync instance are not getting auto-preserved despite being disabled in AzureAD. They continue to show up under the Active User License Count.

Cause

Following are the possible causes:

1. The AzureAD Account of the User was disabled already, before it was imported to Druva.

2. Pending AzureAD sync interval.

3. Insufficient Licenses in Druva.

Resolution

• Existing disabled users from Azure, when imported to Druva, will remain as Active users in Druva, as there is no change in the user’s state post importing them to Druva. To preserve such users, either of the following can be done:

  • Edit Azure AD Attribute: Edit any attribute of such users in Azure, for example, Display Name. This will trigger a sync for these users and on the next sync, the users will be preserved automatically.

  • Manually Preserve Users:  Manually preserve these users from inSync Admin Console as explained in this document.

  • Using Druva Developer APIs: Druva has public facing APIs available to manage your users via API Scripts. You may click on this link and preserve the users via API. 

Note: Composing custom API Scripts is not supported by Druva. 

• Azure AD Sync runs once every 24 hours. Check the last sync time in the Admin Console -> Users -> Deployment page and if the sync has not run yet, then you can trigger a sync manually by clicking on “Start Sync”.

• If the Active as well as Preserve User License limit is reached, users can no longer be converted into Preserved. You need to free up the licenses by deleting the unwanted user accounts or removing their assigned licenses.

Note: Deleting the user OR removing the license, both of these actions lead to a permanent data loss of the user’s backed up data across all of the workloads. Proceed with this option with caution.