Users & Access backup

Back up and restore users, memberships, and app assignments.

What Users & Access backup captures

Separate from config, Users & Access backup (a paid feature) captures who: users (profiles, status), group memberships, and app assignments, with provenance preserved (group-inherited vs directly-assigned access). It has its own schedule, retention, and storage per tenant. Supported for all three providers; the exact shape follows each provider's model - for Auth0 that means users plus role assignments and organization memberships (Auth0 has no user-to-app assignment concept, so that bucket doesn't apply).

Rate limits & estimates

Users & Access exports can be API-heavy on large orgs. IdPVault paces itself with an adaptive rate limiter (learns your Okta org's limits, keeps configurable headroom) and shows a measured duration estimate with a cadence recommendation before you commit to a schedule. Backups and restores run as background jobs and show live progress while running: a percentage when a previous run gives an expected size, otherwise a live API call count.

The snapshot list shows a changes vs previous summary per snapshot (users, memberships, and assignments added or removed), and the tenant Overview's Live State panel can show the live user directory compared against your latest snapshot - see the Live State doc.

Users & Access restore

Restore is additive: it recreates missing users (deactivated state, matched by login/username), re-adds group memberships, and re-links app assignments. It never deletes anything. Existing users are normally left untouched; users whose profile fields differ from the snapshot can be individually selected for a profile revert (opt-in, unchecked by default) that overwrites those fields with the snapshot values. Credentials and MFA are never touched, and Auth0 email changes are deliberately not reverted (email changes trigger verification side effects). Everything is resolved by natural key, so recreated objects with new internal ids don't break the links. A dry-run preview shows exactly who and what would be recreated or reverted, with per-user checkboxes and the changed fields listed per user. Renamed users are recognized by their immutable server id (Authentik pk / Okta id / Auth0 user_id), so a username change shows up as a revertable change - never as a delete-plus-duplicate.

Caveats

• Recreated users arrive deactivated without passwords/MFA; they re-enroll on activation. IdPs never export credential material.
• Authentik app access is governed by policy bindings, which live in config restore; run both for full recovery.
• Auth0: recreated users come back blocked with a random password - send a password reset, then unblock. Only database-connection users can be recreated via the API (social/enterprise users sign in again through their IdP). Tenants over 1,000 users need the bulk export job, which is on the roadmap - the backup fails loudly rather than being silently partial.