This article explains how to remove a user from a Hub, remove a user from all Hubs in a tenancy, and handle account deletion. It also covers what happens to shared files when a user is removed, and the differences between standard and SSO account offboarding.
This article is intended for Hub Administrators and Tenancy Managers. Regular users who want to leave a Hub should contact their Hub Administrator or Tenancy Manager.
Ways to remove users
There are three levels of user removal, each with different consequences:
Action | Who can do it | What happens |
Remove user from a single Hub | Hub admin or Tenancy Manager | User loses access to that Hub's content. Their DekkoCORE account and other Hub memberships are unaffected. |
Remove from all Hubs in a tenancy | Tenancy Manager | User loses access to all Hubs in your tenancy. They can still log in to DekkoCORE but have no access to tenancy content. |
Full account deletion | DekkoSecure support | Account and all associated data are permanently deleted. Encryption keys are erased. |
In most offboarding scenarios, removing a user from all Hubs is sufficient. Full account deletion is only necessary when the account itself must be permanently removed for compliance or security reasons.
Removing a user from Hub(s)
Users will not be notified when being removed from a hub. Both Tenancy Managers and Hub Administrators can remove users from Hub(s). Removing a user from hub(s) as a Tenancy Manager:
- Open the Tenancy Manager interface.
- In the left dropdown menu, select the Tenancy in which the hub is in.
- Select the Users tab,
- Search or locate the user and click the [⋯] button.
- Select the Manage Memberships.
- Update the user’s membership type to not a member for the Hub.
or as a Hub Administrator:
- Open Settings in the left navigation bar.
- Select the Hub settings tab and choose your Hub from the dropdown list.
- Go to the User management tab.
- Locate the user and remove them from the Hub(s).
Removing a user from all Hubs in a Tenancy
Tenancy Managers can remove a user from all Hubs at once:
- Open the Tenancy Manager view.
- In the left dropdown menu, select the Tenancy in which the hub is in.
- Select Users in the left navigation bar.
- Search or locate the user and click the [⋯] button.
- Select the Remove User.
- To verify the removal of the user, type the user’s email.
- Click Ok to confirm removal
After this action, the user will no longer have access to any Hubs or files within your tenancy. However, they can still log in to DekkoCORE and access Hubs in other Tenancies. Their account is not deleted.
Full account deletion
To permanently delete a user's DekkoCORE account, contact DekkoSecure support. Account deletion is irreversible and results in the following:
- All files owned by the user are permanently deleted.
- Encryption keys for all deleted data are erased.
- Encrypted data is overwritten and then removed.
- The user's Hub memberships, messages, signatures, stamps, and profile data are deleted.
- Files that were shared with the user by others (with Full permissions) remain accessible to the original owner and other shared users.
Account deletion cannot be undone. Ensure you have retrieved or reassigned any critical files owned by the user before requesting deletion.
SSO user offboarding
If your organisation uses Single Sign-On (SSO) via Entra ID / Azure Active Directory, additional considerations apply:
- Deleting or disabling a user in Entra ID will prevent them from logging in to DekkoCORE.
- If the user is deleted in Entra ID (not just disabled), their DekkoCORE encryption key stored in the Entra ID extension attribute is also deleted. This means their files and account data will be permanently lost.
- If the user is disabled in Entra ID but not deleted, their account data is preserved. Re-enabling the account will restore access.
Important For SSO users, disabling the Entra ID account is the recommended offboarding option. It immediately blocks access to DekkoCORE while preserving the user's data in case files need to be retrieved. Only delete the Entra ID account once you have confirmed that no critical files are owned exclusively by that user.
See the Entra ID SSO Integration article for details on SSO configuration.
What happens to shared files when a user is removed
Files owned by the removed user
This depends on whether the files have been shared with other users in the hub or if the Central Access Admin or Central Backup Policy is turned on. If the files have been shared with other users and/or the policies have been turned on, other users and/or Central Access or Backup Accounts still got access to the files after the user has been removed. If the files weren’t shared before removing the access and the policies were not centrally turned on for the Tenancy, no one will have access to them after removing the user.
If a removed user gets added to the same Hub again using the same account, they will regain access to any files which they previously had access to within the Hub.
Files shared with the removed user
When a user is removed from a Hub, they lose access to all files that were shared with them in that Hub. If the user previously downloaded files, their local copies are unaffected. The original files and their sharing configuration with other users are not changed.
Retrieving files before offboarding
Before removing or deleting a user, review whether they own files that other users or your organisation still need. If they do:
- Ask the user to share the relevant files with another user using Full permissions before they are offboarded. This effectively transfers co-ownership.
- Alternatively, have the user download and hand over the files to a colleague who can re-upload them.
Please be aware of the medium you chose for handing over any sensitive or official files. It is recommended to go with the first option which keeps the data within DekkoCORE.
DekkoDrive is the fastest way to synchronise all content associated with you account to your device. Please contact your DekkoSecure account manager to request access to DekkoDrive. If your Tenancy has the Central Access Admin or Central Backup Account policy enabled, you can use this account and DekkoDrive to quickly synchronise all content from your Tenancy.
Offboarding checklist
Before removing a user, work through the following:
- Identify all Hubs the user is a member of. Tenancy Managers can see this from the user management page.
- Determine whether the user owns any files that others still need. If so, arrange transfer (see above).
- Remove sharing access to any files the user shared with external parties, if those shares should not persist.
- Remove the user from individual Hubs, or remove from all Hubs at once via the Tenancy Manager.
- For SSO users, disable or delete the user in Entra ID according to your organisation's policy.
- For complete account deletion, contact DekkoSecure support.
- Review the audit log to confirm the removal was completed as expected.
FAQ
I am not a Tenancy Manager. Can I still remove users?
Hub admins can remove users from Hubs they administer, but cannot remove users from other Hubs or delete users from the Tenancy. If you need to remove a user across multiple Hubs, contact your Tenancy Manager.
A user wants to leave a Hub themselves
Users can leave a Hub following these steps:
- Opening Settings in the left navigation bar.
- Select the Hub settings tab.
- Choose the Hub from the dropdown list.
- Then select Leave Hub.
- Click the Leave Hub button.
- Type the name of the Hub to confirm you’d like to leave the Hub and click Ok to confirm.
A user has left the organisation but I need access to their files
If the user's account still exists (standard account) or is disabled but not deleted (SSO account), their files remain on the platform. Contact DekkoSecure support to discuss options for accessing or recovering the files. If the account has been fully deleted, file encryption keys have been erased and the files cannot be recovered.