The discussion revolves around handling a deactivated account for a client who was auto-registered via SSO. Helga_Razinkova asks if deactivating the account and disabling notifications would suffice, as a full deletion might not prevent re-registration. pfaffman suggests suspending the user to block login. maiki adds that while suspension prevents access, it may not meet the client’s request to avoid any trace of their user data on the site, suggesting the issue might be better resolved at the SSO identity provider level.
Here’s the thing: we have an SSO authorization, meaning a user gets automatically signed up when going to the forum from our dashboard.
The question: a client of ours wasn’t quite happy about being auto-authorised and requested to delete his account. I guess a complete delete wouldn’t work here, since he might appear on the forum from the dashboard once again and get registered again.
Can I just switch off the notifications for him and deactivate the account? Do you think it will be enough?
You might be able to control this via your SSO identity provider, to mark that client’s account so it is not auto-authorized.
Adding: suspending as Jay mentioned will prevent them from logging in and interacting with the site, but I would be concerned it does not meet the criteria the client is asking, which may not want their user information showing up anywhere in the Discourse site.
