Automatically Disable Inactive OPS Accounts

[tdonaworth]

User Story

As an OPS System Admin, I want any existing active OPS user who hasn't successfully used OPS within the last 60 days to automatically be locked out in order to help meet mandatory compliance obligations.

Acceptance Criteria

• Without any human intervention, an automated and scheduled process should execute to discern any currently ACTIVE users who most recently logged on or started a session 60 or more days ago to have their status set to INACTIVE
• Any such change in status executed by this process should be recorded and logged in the same manner as if a System Admin manually disabled the user
• The schedule for this process's execution should be hourly until otherwise directed by OPRE.
• If this scheduled process is not able to execute as expected, the necessary individuals should be notified.
• FakeAuth users should be excluded from this process

---

Tasks

UX

Dev

• Azure Function with a timer trigger ? backed endpoints to do the checking and locking?

• SPIKE: Infra: Investigate using Azure Container App Jobs to run hourly process #2655
• SPIKE: Infra: Investigate using Celery to run hourly process #2656
• Implement SQLAlchemy script to disable User Accounts in Azure Container App Job #2756
• Deploy disable-user job to Stage #3169
• Deploy disable-user job to Production #3170

Definition of Done Checklist

- [ ] UI works as designed (UX team)

• PR(s) have been merged to main
• Design/tech debt eliminated
• New design/tech debt documented (if applicable)
• Build process updated
• Documentation updated or added
• Feature flags/toggles created

Additional Context & Resources

• https://github.com/HHS/OPRE-OPS/blob/main/docs/Security-Compliance/Security-Controls/ac/ac-02-03.md
• A user could be active and have logged in within the past 60 days to AMS, but not OPS.
• Ideally we'd email about this when we're to that point.

[maiyerlee]

From team discussion at ENG Collab Block today (8/26): consider creating a new user specifically for automatic updates triggered by running scripts.