New reactivation policy for deactivated users

What’s changing?

Smartsheet allows you to enhance security and cost management by enabling the deactivation of users who have left your organization. 

In an effort to strengthen this capability and prevent the accidental reactivation of deactivated users, we'll be imposing a restriction on the ability to reactivate a user (via Admin Center or APIs) after a period of seven consecutive days from being deactivated. In other words, System Admins won’t be able to reactivate those users on the eighth day or thereafter. 

The seven-day grace period allows System Admins to quickly rectify any deactivation errors while maintaining security beyond that point. This policy will apply to users who have been deactivated both before and after January 22, 2024.  
 

What should I know as a System Admin?

Past the seven-day period, we advise you to use the Remove User option and re-invite the same individual instead of trying to reactivate the previously deactivated account.

• The Admin Center and API calls will display an error message if you attempt to reactivate a user after more than seven days from being deactivated.
• When deactivating a user, you'll receive a prompt in the Admin Center informing you of the seven-day window for a potential reactivation.
• When removing (or deleting) a user, you can also decide whether to remove their sharing permissions. You can do this by checking or unchecking the Remove access from all items owned by anyone in the account checkbox.
• If you don't choose to remove the user's sharing permissions when doing the Remove User action, then if they're reinvited to the same plan, they'll retain their original level access to various assets. 
• If User Auto Provisioning (UAP) is enabled in your domain and your plan allows for email/password-based login, removing a deactivated user will enable them to log back into Smartsheet. As a result of the UAP setup in your domain, they'll be automatically re-added to your plan.