Deleting users

You can manually delete a user in the Users module for any reason, for example, to remove a user's personal information when they leave your company.

When you delete a user, you remove their directory information and labels. Additionally, you remove all references to the user, such as where they are associated with events, detections, incidents, and nodes. To indicate a user was historically associated with an event, the text "[DELETED]" will replace the user's details.

A deleted user can be manually restored via the api/v1/admin/users/restore FortiDLP API endpoint. Once they are restored, they will be set to the state "Archived (never enrolled)", and they then need to be re-synced or re-imported to FortiDLP so that they will be unarchived and re-associated with their events.

Deleted user record in the Users module

Ensure you make a note of a user's Agent UUID before deleting them so that you can manage shadow copies.

How to delete a user

1. In the FortiDLP Console, on the left-hand sidebar, click .
2. Filter the page to locate the user you want to delete. For guidance, see Viewing users.
3. In the Users table, on the relevant user's table row, click > Delete user.
   
   
4. In the confirmation box, provide a reason.
5. Click Delete user.