[[["์ดํดํ๊ธฐ ์ฌ์","easyToUnderstand","thumb-up"],["๋ฌธ์ ๊ฐ ํด๊ฒฐ๋จ","solvedMyProblem","thumb-up"],["๊ธฐํ","otherUp","thumb-up"]],[["์ดํดํ๊ธฐ ์ด๋ ค์","hardToUnderstand","thumb-down"],["์๋ชป๋ ์ ๋ณด ๋๋ ์ํ ์ฝ๋","incorrectInformationOrSampleCode","thumb-down"],["ํ์ํ ์ ๋ณด/์ํ์ด ์์","missingTheInformationSamplesINeed","thumb-down"],["๋ฒ์ญ ๋ฌธ์ ","translationIssue","thumb-down"],["๊ธฐํ","otherDown","thumb-down"]],["์ต์ข ์ ๋ฐ์ดํธ: 2024-07-11(UTC)"],[[["\u003cp\u003eThis document explains how to identify user accounts in Cloud Identity or Google Workspace that are "orphaned," meaning they lack a corresponding identity in the external authoritative source.\u003c/p\u003e\n"],["\u003cp\u003eOrphaned accounts can arise from manual user creation in Cloud Identity/Google Workspace or from migrating consumer accounts with non-matching identities.\u003c/p\u003e\n"],["\u003cp\u003eIdentifying orphaned accounts requires comparing user lists from Cloud Identity/Google Workspace against your external source (e.g., Active Directory, Azure AD) using a CSV export and PowerShell commands.\u003c/p\u003e\n"],["\u003cp\u003eReconciling orphaned accounts involves determining if the account is obsolete, transferring its data if needed, or fixing the primary email to match the external source.\u003c/p\u003e\n"],["\u003cp\u003eRegular reconciliation is recommended, particularly after migrating consumer accounts, to prevent the accumulation of orphaned user accounts.\u003c/p\u003e\n"]]],[],null,["# Reconcile orphaned managed user accounts\n\nThis document describes how to identify and reconcile orphaned user accounts.\n\nIf you use an\n[external identity provider (IdP)](/architecture/identity/reference-architectures#using_an_external_idp),\nthen the authoritative source for identities is external to\n[Cloud Identity](/identity)\nor\n[Google Workspace](https://gsuite.google.com/).\nEach identity in Cloud Identity or Google Workspace should\ntherefore have a counterpart in the\n[external authoritative source](/architecture/identity/overview-google-authentication#external_authoritative_source).\nIt's possible that some of the identities in your Cloud Identity or\nGoogle Workspace account lack a counterpart in your external authoritative\nsource---if so, these user accounts are considered *orphaned*. Orphaned accounts\ncan occur under the following circumstances:\n\n- A Cloud Identity or Google Workspace administrator has manually created a user account that has a non-matching identity.\n- You have [migrated a consumer account](/architecture/identity/migrating-consumer-accounts#surfacing_unmanaged_user_accounts) to Cloud Identity or Google Workspace, but the account uses an identity that does not match any existing identity in the external source.\n\nBefore you begin\n----------------\n\nTo reconcile orphaned managed user accounts, you must meet the following\nprerequisites:\n\n- You have [identified a suitable onboarding plan](/architecture/identity/assessing-onboarding-plans) and have completed all prerequisites for consolidating your existing user accounts.\n- You have created a [Cloud Identity or Google Workspace account](/architecture/identity/overview-google-authentication#cloud_identity_or_g_suite_account).\n\nProcess\n-------\n\nTo reconcile orphaned user accounts, you must first identify which user\naccounts are orphaned. For each user account, you then have to decide how to\nbest reconcile that account.\n\n### Identify orphaned user accounts\n\nTo find orphaned user accounts, you must compare the identities of user\naccounts in Cloud Identity or Google Workspace against the\nidentities that are recognized by your authoritative source.\n\nTo perform a comparison, you can use the export functionality of a\nGoogle Workspace or Cloud Identity account to obtain a list of\nyour current user accounts:\n\n1. In the Admin Console, go to the [**Users**](https://admin.google.com/ac/users) page.\n2. Select **Download users**.\n3. Select **All user info columns and currently selected columns**.\n4. Click **Download**.\n\n After a few minutes, depending on the number of user accounts you have, you\n see a notification that the user info CSV file is ready to be downloaded.\n5. Click **Download CSV** and save the file to your local disk.\n\n | **Note:** The CSV export might contain personally identifiable information (PII). Make sure that you select a storage location that is protected against unauthorized access.\n\nIf you use Active Directory or Microsoft Entra ID (formerly Azure Active\nDirectory) as your authoritative source, follow these steps to compare identities: \n\n### Active Directory\n\n1. Sign on to a workstation that has access to Active Directory.\n2. Open a PowerShell console.\n3. Set a variable to the location of your downloaded file:\n\n ```\n $GoogleUsersCsv=\"GOOGLE_PATH\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eGOOGLE_PATH\u003c/var\u003e with the path to the\n CSV file that you downloaded before.\n4. Determine the list of user accounts that lack a counterpart in Active\n Directory:\n\n $GoogleUsers = (Import-Csv -Path $GoogleUsersCsv -Header FirstName,LastName,Email | Select-Object -Skip 1)\n $LdapFilter = \"(|{0})\" -f (($GoogleUsers | Select-Object @{Name=\"Clause\";Expression={\"(userPrincipalName=$($_.Email))\"}} | Select-Object -ExpandProperty Clause) -join \"\")\n\n $GoogleUsersWithMatch = Get-ADUser -LdapFilter $LdapFilter `\n | Select-Object -ExpandProperty UserPrincipalName\n\n $GoogleUsers | Where-Object {$_.Email -NotIn $GoogleUsersWithMatch}\n\n The command compares the primary email address of user accounts\n in Cloud Identity or Google Workspace against the\n `userPrincipalName` attribute in Active Directory. If you are\n using a different mapping between Active Directory users and\n Cloud Identity or Google Workspace user accounts, you\n might need to adjust the command.\n | **Note:** If the CSV file contains a large number of users, the `Get-ADUser` command might take several minutes to execute and might cause significant load on the associated domain controller.\n\n The output is similar to this: \n\n ```\n FirstName LastName Email\n --------- -------- -----\n Alice Admin admin@example.org\n Olly Orphaned olly@example.org\n Matty Mismatch matty@wrongsubdomain.example.org\n ```\n\n Each item listed in the output represents a user account in\n Cloud Identity or Google Workspace that lacks a\n counterpart in Active Directory.\n\n An empty result indicates that you don't have any orphaned user\n accounts in Google Workspace or Cloud Identity.\n5. Delete the CSV file from your local disk.\n\n### Entra ID\n\n1. In the [Azure Portal](https://portal.azure.com), go to **Azure Active Directory Users**.\n2. Click **Download users**.\n3. Enter a filename and click **Start**.\n\n Wait until a **Click here to download** link appears.\n\n Depending on the number of user accounts you have, it might take a few\n minutes for the operation to complete.\n4. Click **Click here to download** and save the file to your local disk.\n\n | **Note:** The CSV export might contain personally identifiable information (PII). Make sure that you select a storage location that is protected against unauthorized access.\n5. On a workstation that has PowerShell installed, open a PowerShell\n console.\n\n6. Set two environment variables:\n\n ```\n $GoogleUsersCsv=\"GOOGLE_PATH\"\n $AzureUsersCsv=\"AZURE_PATH\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eGOOGLE_PATH\u003c/var\u003e and\n \u003cvar translate=\"no\"\u003eAZURE_PATH\u003c/var\u003e with the file paths to the CSV files\n that you previously downloaded.\n7. Determine the list of user accounts that lack a counterpart in Active\n Directory:\n\n $GoogleUsers = (Import-Csv -Path $GoogleUsersCsv\n -Header FirstName,LastName,Email | Select-Object -Skip 1)\n\n $AzureUsers = (Import-Csv -Path $AzureUsersCsv)\n\n $GoogleUsers | Where-Object {$_.Email -NotIn ($AzureUsers | Select-Object -ExpandProperty userPrincipalName)}\n\n The command compares the primary email address of user accounts\n in Cloud Identity or Google Workspace against the\n `userPrincipalName` attribute in Entra ID. If you are using a\n different mapping between Entra ID users and the Cloud Identity\n or Google Workspace user accounts, you might need to adjust the\n command.\n\n The output is similar to the following: \n\n ```\n FirstName LastName Email\n --------- -------- -----\n Alice Admin admin@example.org\n Olly Orphaned olly@example.org\n Matty Mismatch matty@wrongsubdomain.example.org\n ```\n\n Each item listed in the output represents a user account in\n Cloud Identity or Google Workspace that lacks a\n counterpart in Active Directory.\n\n An empty result indicates that you don't have any orphaned user\n account in Google Workspace or Cloud Identity.\n8. Delete both CSV files from your local disk.\n\n### Reconcile orphaned user accounts\n\nTo reconcile orphaned user accounts, you have to analyze each user account\nto determine why its identity lacks a counterpart in your\nauthoritative source system.\n\nIf you think a user account is obsolete, check whether any configuration\nsettings or data associated with the account are worth preserving:\n\n- To keep existing Google Drive data, [transfer the data](https://support.google.com/a/answer/1247799?hl=en) to a different user.\n- If you don't want to keep any existing configuration settings or data, delete the user account.\n- To temporarily retain the user account, suspend the user account and change its primary email address to an address that is unlikely to ever [cause a collision](/architecture/identity/best-practices-for-federating#make_cloud_identity_or_g_suite_identities_a_subset_of_the_identities_in_your_external_idp). For example, rename `olly.obsolete@example.com` to `obsolete-2019-11-10-olly.obsolete@example.com`.\n\nFor each user account that is still valid, try to fix the primary email address\nso that it matches an identity in your authoritative source. This might require\nthe following:\n\n- Changing the domain of the primary email address.\n- Swapping the primary email address and an alias address.\n- Fixing casing or spelling of the primary email address (for example, adding or removing dots).\n\n| **Note:** Changing the primary email address impacts the owner of the associated user account. Make sure that you notify the owner of the change so that they know which email address to use for subsequent sign-ins.\n\nBest practices\n--------------\n\nWe recommend the following best practices when you are reconciling managed user\naccounts:\n\n- If you migrate consumer accounts to Cloud Identity or Google Workspace, repeat the reconciliation process at least once for every batch of user accounts that you migrate."]]
