Merekonsiliasi akun pengguna terkelola yang terlantar
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Last reviewed 2024-07-11 UTC
Dokumen ini menjelaskan cara mengidentifikasi dan merekonsiliasi akun pengguna terlantar.
Jika Anda menggunakan
penyedia identitas (IdP) eksternal,
maka sumber otoritatif untuk identitas berada di luar
Cloud Identity
atau
Google Workspace.
Oleh karena itu, setiap identitas di Cloud Identity atau
Google Workspace harus memiliki padanan di
sumber otoritatif eksternal.
Ada kemungkinan bahwa beberapa identitas di akun Cloud Identity atau
Google Workspace Anda tidak memiliki padanan di sumber otoritatif
eksternal Anda—Jika demikian, akun pengguna ini dianggap terlantar. Akun terlantar
dapat terjadi dalam keadaan berikut:
Administrator Cloud Identity atau Google Workspace telah
membuat akun pengguna tanpa identitas yang cocok secara manual.
Anda telah
memigrasikan akun konsumen
ke Cloud Identity atau Google Workspace, tetapi akun tersebut menggunakan
identitas yang tidak cocok dengan identitas apa pun yang ada di sumber eksternal.
Sebelum memulai
Untuk merekonsiliasi akun pengguna terkelola yang terlantar, Anda harus memenuhi prasyarat
berikut:
Untuk merekonsiliasi akun pengguna terlantar, Anda harus terlebih dahulu mengidentifikasi akun pengguna
yang usang. Untuk setiap akun pengguna, Anda harus memutuskan cara
terbaik untuk merekonsiliasi akun tersebut.
Mengidentifikasi akun pengguna terlantar
Untuk menemukan akun pengguna terlantar, Anda harus membandingkan identitas akun
pengguna di Cloud Identity atau Google Workspace dengan
identitas yang dikenali oleh sumber otoritatif Anda.
Untuk melakukan perbandingan, Anda dapat menggunakan fungsi ekspor
akun Google Workspace atau Cloud Identity untuk mendapatkan daftar
akun pengguna Anda saat ini:
Pilih Semua kolom info pengguna dan kolom yang saat ini dipilih.
Klik Download.
Setelah beberapa menit, bergantung pada jumlah akun pengguna yang Anda miliki, Anda
akan melihat notifikasi bahwa file CSV info pengguna siap didownload.
Klik Download CSV, lalu simpan file ke disk lokal Anda.
Jika Anda menggunakan Active Directory atau Microsoft Entra ID (sebelumnya Azure
Active Directory) sebagai sumber resmi, ikuti langkah-langkah berikut untuk membandingkan identitas:
Active Directory
Login ke workstation yang memiliki akses ke Active Directory.
Buka konsol PowerShell.
Tetapkan variabel ke lokasi file yang Anda download:
$GoogleUsersCsv="GOOGLE_PATH"
Ganti GOOGLE_PATH dengan jalur ke
file CSV yang Anda download sebelumnya.
Tentukan daftar akun pengguna yang tidak memiliki padanan di Active
Directory:
Perintah ini membandingkan alamat email utama akun pengguna
di Cloud Identity atau Google Workspace dengan
atribut userPrincipalName di Active Directory. Jika
menggunakan pemetaan berbeda antara pengguna Active Directory dan
akun pengguna Cloud Identity atau Google Workspace, Anda
mungkin perlu menyesuaikan perintah tersebut.
Setiap item yang tercantum dalam output mewakili akun pengguna di
Cloud Identity atau Google Workspace yang tidak memiliki
padanan di Active Directory.
Hasil kosong menunjukkan bahwa Anda tidak memiliki akun pengguna
terlantar di Google Workspace atau Cloud Identity.
Hapus file CSV dari disk lokal Anda.
Entra ID
Di Portal Azure,
buka Pengguna Azure Active Directory.
Klik Download pengguna.
Masukkan nama file, lalu klik Mulai.
Tunggu hingga link Klik di sini untuk mendownload muncul.
Bergantung pada jumlah akun pengguna yang Anda miliki, mungkin perlu waktu beberapa
menit untuk menyelesaikan operasi.
Klik Klik di sini untuk mendownload dan menyimpan file ke disk lokal Anda.
Di workstation yang telah menginstal PowerShell, buka konsol
PowerShell.
Perintah ini membandingkan alamat email utama akun pengguna
di Cloud Identity atau Google Workspace dengan
atribut userPrincipalName di Entra ID. Jika menggunakan
pemetaan berbeda antara pengguna Entra ID dan akun pengguna
Cloud Identity atau Google Workspace, Anda mungkin perlu menyesuaikan
perintah tersebut.
Setiap item yang tercantum dalam output mewakili akun pengguna di
Cloud Identity atau Google Workspace yang tidak memiliki
padanan di Active Directory.
Hasil kosong menunjukkan bahwa Anda tidak memiliki akun pengguna
terlantar di Google Workspace atau Cloud Identity.
Hapus kedua file CSV dari disk lokal Anda.
Merekonsiliasi akun pengguna terlantar
Untuk merekonsiliasi akun pengguna terlantar, Anda harus menganalisis setiap akun pengguna
untuk mengetahui mengapa identitasnya tidak memiliki padanan dalam
sistem sumber otoritatif Anda.
Jika menurut Anda akun pengguna sudah tidak berlaku, periksa apakah setelan
konfigurasi atau data yang terkait dengan akun tersebut pantas dipertahankan:
Untuk menyimpan data Google Drive yang sudah ada,
transfer data
ke pengguna yang berbeda.
Jika Anda tidak ingin menyimpan setelan konfigurasi atau data yang sudah ada,
hapus akun pengguna.
Untuk mempertahankan akun pengguna untuk sementara, tangguhkan akun pengguna dan
ubah alamat email utamanya menjadi alamat yang kemungkinan tidak akan
menyebabkan benturan.
Misalnya, ganti nama olly.obsolete@example.com menjadi
obsolete-2019-11-10-olly.obsolete@example.com.
Untuk setiap akun pengguna yang masih valid, cobalah untuk memperbaiki alamat email utama
sehingga cocok dengan identitas di sumber otoritatif Anda. Proses ini mungkin memerlukan
hal berikut:
Mengubah domain alamat email utama.
Menukar alamat email utama dan alamat alias.
Memperbaiki kapitalisasi atau ejaan alamat email utama (misalnya,
menambahkan atau menghapus titik).
Praktik terbaik
Kami merekomendasikan praktik terbaik berikut saat Anda merekonsiliasi akun pengguna
terkelola:
Jika Anda memigrasikan akun konsumen ke Cloud Identity atau
Google Workspace, ulangi proses rekonsiliasi setidaknya sekali untuk
setiap batch akun pengguna yang Anda migrasikan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2024-07-11 UTC."],[[["\u003cp\u003eThis document explains how to identify user accounts in Cloud Identity or Google Workspace that are "orphaned," meaning they lack a corresponding identity in the external authoritative source.\u003c/p\u003e\n"],["\u003cp\u003eOrphaned accounts can arise from manual user creation in Cloud Identity/Google Workspace or from migrating consumer accounts with non-matching identities.\u003c/p\u003e\n"],["\u003cp\u003eIdentifying orphaned accounts requires comparing user lists from Cloud Identity/Google Workspace against your external source (e.g., Active Directory, Azure AD) using a CSV export and PowerShell commands.\u003c/p\u003e\n"],["\u003cp\u003eReconciling orphaned accounts involves determining if the account is obsolete, transferring its data if needed, or fixing the primary email to match the external source.\u003c/p\u003e\n"],["\u003cp\u003eRegular reconciliation is recommended, particularly after migrating consumer accounts, to prevent the accumulation of orphaned user accounts.\u003c/p\u003e\n"]]],[],null,["# Reconcile orphaned managed user accounts\n\nThis document describes how to identify and reconcile orphaned user accounts.\n\nIf you use an\n[external identity provider (IdP)](/architecture/identity/reference-architectures#using_an_external_idp),\nthen the authoritative source for identities is external to\n[Cloud Identity](/identity)\nor\n[Google Workspace](https://gsuite.google.com/).\nEach identity in Cloud Identity or Google Workspace should\ntherefore have a counterpart in the\n[external authoritative source](/architecture/identity/overview-google-authentication#external_authoritative_source).\nIt's possible that some of the identities in your Cloud Identity or\nGoogle Workspace account lack a counterpart in your external authoritative\nsource---if so, these user accounts are considered *orphaned*. Orphaned accounts\ncan occur under the following circumstances:\n\n- A Cloud Identity or Google Workspace administrator has manually created a user account that has a non-matching identity.\n- You have [migrated a consumer account](/architecture/identity/migrating-consumer-accounts#surfacing_unmanaged_user_accounts) to Cloud Identity or Google Workspace, but the account uses an identity that does not match any existing identity in the external source.\n\nBefore you begin\n----------------\n\nTo reconcile orphaned managed user accounts, you must meet the following\nprerequisites:\n\n- You have [identified a suitable onboarding plan](/architecture/identity/assessing-onboarding-plans) and have completed all prerequisites for consolidating your existing user accounts.\n- You have created a [Cloud Identity or Google Workspace account](/architecture/identity/overview-google-authentication#cloud_identity_or_g_suite_account).\n\nProcess\n-------\n\nTo reconcile orphaned user accounts, you must first identify which user\naccounts are orphaned. For each user account, you then have to decide how to\nbest reconcile that account.\n\n### Identify orphaned user accounts\n\nTo find orphaned user accounts, you must compare the identities of user\naccounts in Cloud Identity or Google Workspace against the\nidentities that are recognized by your authoritative source.\n\nTo perform a comparison, you can use the export functionality of a\nGoogle Workspace or Cloud Identity account to obtain a list of\nyour current user accounts:\n\n1. In the Admin Console, go to the [**Users**](https://admin.google.com/ac/users) page.\n2. Select **Download users**.\n3. Select **All user info columns and currently selected columns**.\n4. Click **Download**.\n\n After a few minutes, depending on the number of user accounts you have, you\n see a notification that the user info CSV file is ready to be downloaded.\n5. Click **Download CSV** and save the file to your local disk.\n\n | **Note:** The CSV export might contain personally identifiable information (PII). Make sure that you select a storage location that is protected against unauthorized access.\n\nIf you use Active Directory or Microsoft Entra ID (formerly Azure Active\nDirectory) as your authoritative source, follow these steps to compare identities: \n\n### Active Directory\n\n1. Sign on to a workstation that has access to Active Directory.\n2. Open a PowerShell console.\n3. Set a variable to the location of your downloaded file:\n\n ```\n $GoogleUsersCsv=\"GOOGLE_PATH\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eGOOGLE_PATH\u003c/var\u003e with the path to the\n CSV file that you downloaded before.\n4. Determine the list of user accounts that lack a counterpart in Active\n Directory:\n\n $GoogleUsers = (Import-Csv -Path $GoogleUsersCsv -Header FirstName,LastName,Email | Select-Object -Skip 1)\n $LdapFilter = \"(|{0})\" -f (($GoogleUsers | Select-Object @{Name=\"Clause\";Expression={\"(userPrincipalName=$($_.Email))\"}} | Select-Object -ExpandProperty Clause) -join \"\")\n\n $GoogleUsersWithMatch = Get-ADUser -LdapFilter $LdapFilter `\n | Select-Object -ExpandProperty UserPrincipalName\n\n $GoogleUsers | Where-Object {$_.Email -NotIn $GoogleUsersWithMatch}\n\n The command compares the primary email address of user accounts\n in Cloud Identity or Google Workspace against the\n `userPrincipalName` attribute in Active Directory. If you are\n using a different mapping between Active Directory users and\n Cloud Identity or Google Workspace user accounts, you\n might need to adjust the command.\n | **Note:** If the CSV file contains a large number of users, the `Get-ADUser` command might take several minutes to execute and might cause significant load on the associated domain controller.\n\n The output is similar to this: \n\n ```\n FirstName LastName Email\n --------- -------- -----\n Alice Admin admin@example.org\n Olly Orphaned olly@example.org\n Matty Mismatch matty@wrongsubdomain.example.org\n ```\n\n Each item listed in the output represents a user account in\n Cloud Identity or Google Workspace that lacks a\n counterpart in Active Directory.\n\n An empty result indicates that you don't have any orphaned user\n accounts in Google Workspace or Cloud Identity.\n5. Delete the CSV file from your local disk.\n\n### Entra ID\n\n1. In the [Azure Portal](https://portal.azure.com), go to **Azure Active Directory Users**.\n2. Click **Download users**.\n3. Enter a filename and click **Start**.\n\n Wait until a **Click here to download** link appears.\n\n Depending on the number of user accounts you have, it might take a few\n minutes for the operation to complete.\n4. Click **Click here to download** and save the file to your local disk.\n\n | **Note:** The CSV export might contain personally identifiable information (PII). Make sure that you select a storage location that is protected against unauthorized access.\n5. On a workstation that has PowerShell installed, open a PowerShell\n console.\n\n6. Set two environment variables:\n\n ```\n $GoogleUsersCsv=\"GOOGLE_PATH\"\n $AzureUsersCsv=\"AZURE_PATH\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eGOOGLE_PATH\u003c/var\u003e and\n \u003cvar translate=\"no\"\u003eAZURE_PATH\u003c/var\u003e with the file paths to the CSV files\n that you previously downloaded.\n7. Determine the list of user accounts that lack a counterpart in Active\n Directory:\n\n $GoogleUsers = (Import-Csv -Path $GoogleUsersCsv\n -Header FirstName,LastName,Email | Select-Object -Skip 1)\n\n $AzureUsers = (Import-Csv -Path $AzureUsersCsv)\n\n $GoogleUsers | Where-Object {$_.Email -NotIn ($AzureUsers | Select-Object -ExpandProperty userPrincipalName)}\n\n The command compares the primary email address of user accounts\n in Cloud Identity or Google Workspace against the\n `userPrincipalName` attribute in Entra ID. If you are using a\n different mapping between Entra ID users and the Cloud Identity\n or Google Workspace user accounts, you might need to adjust the\n command.\n\n The output is similar to the following: \n\n ```\n FirstName LastName Email\n --------- -------- -----\n Alice Admin admin@example.org\n Olly Orphaned olly@example.org\n Matty Mismatch matty@wrongsubdomain.example.org\n ```\n\n Each item listed in the output represents a user account in\n Cloud Identity or Google Workspace that lacks a\n counterpart in Active Directory.\n\n An empty result indicates that you don't have any orphaned user\n account in Google Workspace or Cloud Identity.\n8. Delete both CSV files from your local disk.\n\n### Reconcile orphaned user accounts\n\nTo reconcile orphaned user accounts, you have to analyze each user account\nto determine why its identity lacks a counterpart in your\nauthoritative source system.\n\nIf you think a user account is obsolete, check whether any configuration\nsettings or data associated with the account are worth preserving:\n\n- To keep existing Google Drive data, [transfer the data](https://support.google.com/a/answer/1247799?hl=en) to a different user.\n- If you don't want to keep any existing configuration settings or data, delete the user account.\n- To temporarily retain the user account, suspend the user account and change its primary email address to an address that is unlikely to ever [cause a collision](/architecture/identity/best-practices-for-federating#make_cloud_identity_or_g_suite_identities_a_subset_of_the_identities_in_your_external_idp). For example, rename `olly.obsolete@example.com` to `obsolete-2019-11-10-olly.obsolete@example.com`.\n\nFor each user account that is still valid, try to fix the primary email address\nso that it matches an identity in your authoritative source. This might require\nthe following:\n\n- Changing the domain of the primary email address.\n- Swapping the primary email address and an alias address.\n- Fixing casing or spelling of the primary email address (for example, adding or removing dots).\n\n| **Note:** Changing the primary email address impacts the owner of the associated user account. Make sure that you notify the owner of the change so that they know which email address to use for subsequent sign-ins.\n\nBest practices\n--------------\n\nWe recommend the following best practices when you are reconciling managed user\naccounts:\n\n- If you migrate consumer accounts to Cloud Identity or Google Workspace, repeat the reconciliation process at least once for every batch of user accounts that you migrate."]]
