How is your experience with the OutSystems Community?
19
Views
2
Comments
Best Practice for Managing Long-Inactive External Users and Automatic Reactivation

Hi everyone,

I have an application with a large number of external users. Many of these users access the application only occasionally, in some cases only once or twice a year.

I am considering implementing a user hibernation/inactivation mechanism for users who have not logged in for a defined period, for example, 30 days. One of the objectives is to reduce the active external-user count by making long-inactive users inactive, where permitted under the applicable OutSystems licensing model.

Our proposed approach is:

  1. Identify users who have not logged in for more than 30 days.
  2. Mark those users as Inactive in the OutSystems Users entity.
  3. Maintain the required user/application information separately for historical and reactivation purposes.
  4. When an inactive user attempts to log in, check whether the user exists in our inactive-user repository.
  5. If the user is eligible, automatically reactivate the OutSystems user.
  6. Allow the user to continue with the normal login process.

I would like to understand:

  • Is this approach considered a good practice in OutSystems?
  • Does marking an external user as Inactive reduce the active external-user count for licensing purposes?
  • Are there any security, performance, or licensing considerations with frequently activating/deactivating external users?
  • Would it be better to retain the user record in the OutSystems User entity and set Is_Active = False, rather than moving the user to another table?
  • Are there any limitations when handling a large number of inactive external users?

The main objective is to avoid keeping long-inactive external users as active users throughout the year, particularly for applications where many users may only log in once a year, while still allowing them to regain access automatically when required.

I would appreciate feedback from anyone who has implemented a similar approach.

Thanks in advance.

2026-01-28 16-57-48
Mihai Melencu
Champion

Hi @Manikandan Sambasivam ,

Deactivated users no longer count toward the licensed end-user capacity. However, you should monitor the number of active users during reactivation. If many users return at the same time, you could exceed your licensed capacity. In that case, you would need to upgrade your subscription to remain compliant with the license terms. Having a large number of inactive users should not normally cause any problems.

For the deactivation process, I would create a daily Timer that processes users in batches and applies your validation rules, such as the configured inactivity period. If you need a detailed audit trail, store each result in a separate entity with attributes such as UserId, Reason, DeactivationDate. 

I would not move the user record to another entity or delete it, as this could break references in your applications. Setting Is_Active to False should be sufficient. If GDPR requirements apply, you may also need to pseudonymize or anonymize the user’s personal data.

If you use an external identity provider, you can implement automatic reactivation in the authentication flow after the IdP has successfully validated the user.

2024-07-05 14-16-55
Daniël Kuhlmann
 
MVP

Your approach is valid and used by many organizations that use OutSystems.

Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.