There are three places a person's access can be cut: their link to your sign-in, their membership in your organization, and their account at your identity provider. Each does a different job. When someone leaves, do all three.
| Step | Where | What it ends |
|---|---|---|
| Remove the member | Tamaat, Organization → Members & sharing | Their place in your organization: role, seat, and your organization's work. |
| Remove the link | Tamaat, Organization → Single sign-on | The sessions your sign-in opened for them. |
| Turn them off at your provider | Your identity provider | Their next sign-in through your organization. |
Remove a member
Membership is what lets a person open your organization's work, so this is the step that takes it away.
In Settings, under Organization → Members & sharing, find the person and choose "Remove member". They can no longer open your organization's work, however they sign in. Their own Tamaat account, and anything outside your organization, is not touched.
Removing a member does not remove their link. If you have opened a published map or dashboard to everyone who signs in with your organization, a former member whom your provider still signs in can still open it, as any colleague can. Remove the link and turn them off at your provider to close that too.
Remove a link
A link joins a person's Tamaat account to who they are at your identity provider. Removing it signs them out of what your sign-in opened.
- 1
In Settings, open Organization → Single sign-on and scroll to People. Use "Search people" to find the person.
- 2
Choose "Remove link" on their row.
- 3
Read the confirmation and confirm: "They are signed out of the sessions this sign-in opened and can no longer sign in through your organization until they link their account again. Their account, their membership and their own password are not changed."
What that means in practice:
- It ends their sessions. The sessions your sign-in opened for them stop opening your organization's work at their next request. A map or file already loaded in their browser can stay readable for a short time, and anything already downloaded stays with them.
- It is not a ban. A person who is still a member, or still invited, and whom your provider still signs in, can link again at their next sign-in.
- It does not touch their password. While the policy is Optional, a member with a Tamaat password can still sign in with it. Remove the member to stop that.
Use "Remove link" on its own when a link is wrong, for example a person linked the wrong account. To shut a person out, combine it with the other two steps.
What your identity provider alone does not do
Turning a person off at your provider, or taking Tamaat away from them there, stops their next sign-in through your organization. On its own it does not:
- Remove their membership. They are still listed under Members & sharing, and still hold their seat.
- End a session that is already open. Tamaat is not told when someone is turned off at your provider.
- Stop their Tamaat password. While the policy is Optional, a member who has a password can keep signing in with it.
How long an open session lasts depends on your policy:
| Policy | A person turned off at your provider only |
|---|---|
| Required | Is asked to sign in through your organization again when their sign-in is an hour old, and your provider refuses. From then on your organization's work is closed to them. |
| Optional | Keeps any session that is already open, and can sign in with a password if they have one. |
So do not rely on your provider alone. Remove the member in Tamaat on the day they leave.
A checklist for a leaver
- Remove the member under Organization → Members & sharing.
- Remove the link under Organization → Single sign-on → People.
- Turn them off at your identity provider, following your company's own process.
- Check Activity under Single sign-on: "Person unlinked" is listed with the time.
If the person is your recovery person and single sign-on is required, Tamaat asks you to move that role first: "This person is the recovery person for an organization that requires single sign-on. Choose another recovery person first." See Require Single Sign-On.
Stop everyone at once
To stop all sign-in through a connection, choose "Disable" on it: "People cannot sign in through this connection until it is enabled again. Anyone it signed in is signed out." Memberships and passwords are not changed.