User statuses
User statuses
Every user has a status that controls their state in ADAdmin and in connected platforms (Google Workspace, Entra, Active Directory). Separately, every user also has an independent Protected (Smartsync) setting — see Smartsync off below. Status and Protected are two different fields — changing one never changes the other.
Active
The normal, working state. The user:
- Is included in all sync operations
- Can log in to connected platforms (Google Workspace, Entra, etc.)
- Appears in the default user list
Pending suspension
Not a status you set directly — it's a flag ADAdmin raises automatically when a user drops out of your MIS import (e.g. they've left the school) while their status is still Active. They are scheduled for automatic suspension after a 24-hour grace period, so you get a chance to review before access is cut.
You can see and act on everyone in this state from the Users pending suspension panel on the dashboard — suspend one, several, or everyone immediately, or remove the pending flag if it was raised in error (the Remove pending suspension bulk action). See Users pending suspension for the full walkthrough.
On the Users list, a pending-suspension user shows a small hourglass icon next to their Status badge — the same list also shows a small lock icon there for a Protected/Smartsync-off user (see below). Both are separate indicators layered on top of the Status badge, not the Status itself.
Suspended
The user's account exists but they cannot log in to connected platforms. Use this when someone is temporarily unavailable (e.g. long-term absence) but you may need to restore their access.
- Sync operations still process the user (to keep the account in sync)
- Login is blocked at the platform level
- The account is not deleted from connected platforms
Locked
Locked is a genuine, independent value of the Status field itself — Active, Suspended, Locked, and Deleted are the four choices on the Status dropdown, on the Details tab of the edit user page or when creating a user. Setting a user's Status to Locked does not touch their Protected/Smartsync setting (below) — the two fields are changed separately, on the same form, and don't affect each other.
There's a naming collision worth knowing about, though, so it doesn't trip you up elsewhere:
- The bulk action you see labelled "Smartsync off" on the Users list sends the word
LOCKEDinternally — but what it actually changes is the separate Protected flag (below), not this Status field. Despite sharing that internal name, the bulk action and the Status dropdown value are unrelated. - Some older parts of ADAdmin display a computed "Locked" label for a user whenever they're Protected and Active — that's a calculated on-screen label, not the same thing as this Status value either.
In short: if you see "Locked" as an actual Status on a user (e.g. in the Users list), it's the real, independent status described here. If you see "Locked"/"Smartsync off" as a bulk action, that's the Protected toggle described next.
Smartsync off (Protected) {#smartsync-off-protected}
Smartsync off is a completely separate setting from Status — it's the Protected checkbox on the Details tab (labelled "Protected (exclude from sync deletion)" on the create/edit form). Turning it on:
- Excludes the user from ADAdmin's automated sync-driven changes (e.g. it won't be auto-removed or altered just because it's absent from an MIS import)
- Does not change the user's Status, and does not on its own block login
Use it for accounts that need to be preserved exactly as configured — for example, ones managed manually that shouldn't be overwritten by an import.
You can toggle this per user (the Protected checkbox on their Details tab) or for many users at once with the Smartsync on / Smartsync off bulk actions — both write to the same field, so they can never drift.
A user's Status and their Protected/Smartsync setting are independent. A user can be Active and Protected (this is what shows up elsewhere as "Locked"), Suspended and not Protected, or any other combination — setting one never changes the other.
Deleted
Soft-deleted. The record is kept in ADAdmin for audit history but the user is:
- Excluded from all future sync operations
- Deprovisioned from connected platforms (account suspended or removed, depending on the platform)
- Hidden from the default user list (you can find them by filtering on User status → Deleted)
Deleted users can be restored if needed.
Password-state icons {#password-state-icons}
Two small icons can appear next to a user's name on the Users list and on the Reset passwords page, so you can spot these two states without opening each user:
- ⚠️ Warning triangle — the user's password still matches the school's default password (it's never been changed).
- 🕒 Clock — the user must change their password the next time they log in.
Both icons clear automatically once the condition is no longer true (the password is changed, or the forced-change flag is cleared) — there's nothing to dismiss manually. Use Reset passwords or a user's Details tab on the edit user page to reset a password or set/clear the forced change.
Changing a user's status
You can change status for one user at a time on the Details tab of the edit user page, or for multiple users at once using bulk actions. The Protected/Smartsync setting is changed the same way, but is a separate control on that same tab (or the separate Smartsync on/off bulk actions) — see Smartsync off above.