When a Company Admin deactivates a user, they lose access to the Enterprise subscription and can no longer log in with SSO. Deactivated users can continue to access other Miro subscriptions with the same email.
You can further block deactivated managed users to prevent them from accessing any other Miro subscriptions.
Available for: Enterprise Plan
Who can do it: Company Admins
Blocking deactivated users
When the setting is toggled on: deactivated managed users will be blocked from accessing any Miro subscriptions. This setting applies to all users that are currently deactivated in your subscription and any users you deactivate in the future.
When the setting is toggled off: deactivated managed users can continue to access other Miro subscriptions with their corporate email and password.
💡 Enabling the Block deactivated users setting will impact all previously deactivated users in your subscription. Before you enable the setting, or verify new domains while the setting is enabled, we recommend first reviewing your deactivated users list to understand who will be blocked.
How to block deactivated users
- Go to Company settings > Security & Compliance > Managed domains
- Toggle on Block deactivated users
The blocking deactivated users setting toggled on
What do blocked users see?
Blocked deactivated managed users will be immediately logged out. When they try to log in the next time, they will see one of the following messages:
User attempted to log in with email and password
User attempted to log in with SSO
Unblocking deactivated users
Company Admins can unblock users in three ways:
✏️ Blocking a user’s Miro access means they cannot log in to other Miro subscriptions with their corporate email and password, or via SSO. Unblocking doesn’t give the user access to the Enterprise subscription unless explicitly granted access.
Blocked user scenarios
Use this table to understand more about what happens in different blocked user scenarios.
| Action | Result |
|
User is blocked |
|
| Company admin deactivates managed user | User is blocked |
| A Member of your Enterprise subscription tries to invite a deactivated managed user to their team | User remains blocked. Inviter will see a message that the user is deactivated. They cannot be invited. Admins can reactivate users. |
| Company admin deactivates and deletes a managed user | User is blocked |
| Managed user is deactivated in IdP | User is blocked |
| Managed user is removed from the Miro app/group in IdP | User is blocked |
| Company admin adds and verifies a domain while the setting is enabled | All users from the newly verified domains in the deactivated list are blocked. |
|
Someone from another subscription (any other subscription apart from the one where the domain is verified) tries to invite your deactivated managed user to their subscription. This also applies even if the managed user is deleted from your subscription. |
The user remains blocked. They can be invited to other subscriptions and will receive invitation notifications but cannot log in to Miro. |
|
User is unblocked |
|
| Company admin reactivates a deactivated managed user | User is unblocked |
| Company admin invites a deactivated or deleted managed user back to the subscription. | User is invited and unblocked |
| Managed user is reactivated via SCIM | User is unblocked |
| Managed user is added back to the Miro app/group in IdP and synced via SCIM | User is unblocked |
| A Member of your Enterprise subscription invites a deleted managed user to their team | If the invitation settings allow Members to invite new users to their teams, the user is invited and unblocked. |
|
Mixed scenarios |
|
| The verified domain is deleted from the Domain Control | Deactivated users from the deleted domain are unblocked. Deleted users remain blocked and need to be re-invited to the subscription to become unblocked. |
| The setting is disabled after it has been enabled. | All managed deactivated users are unblocked. Deleted users remain blocked and need to be re-invited to the subscription to become unblocked. |