- Users pending approval
- Block and unblock users
- Activate and deactivate users
- Ban and unban users
- Delete a user
- Troubleshooting
Moderate users (administration)
This is the administration documentation. For information about moderating users at the group level, see the group-level documentation.
GitLab administrators can moderate user access by approving, blocking, banning, or deactivating users.
Users pending approval
A user in pending approval state requires action by an administrator. A user sign up can be in a pending approval state because an administrator has enabled any of the following options:
- Require administrator approval for new sign-ups setting.
- User cap.
- Block auto-created users (OmniAuth)
- Block auto-created users (LDAP)
When a user registers for an account while this setting is enabled:
- The user is placed in a Pending approval state.
- The user sees a message telling them their account is awaiting approval by an administrator.
A user pending approval:
- Is functionally identical to a blocked user.
- Cannot sign in.
- Cannot access Git repositories or the GitLab API.
- Does not receive any notifications from GitLab.
- Does not consume a seat.
An administrator must approve their sign up to allow them to sign in.
View user sign ups pending approval
To view user sign ups pending approval:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- Select the Pending approval tab.
Approve or reject a user sign up
A user sign up pending approval can be approved or rejected from the Admin Area.
To approve or reject a user sign up:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- Select the Pending approval tab.
- For the user sign up you want to approve or reject, select the vertical ellipsis (), then Approve or Reject.
Approving a user:
- Activates their account.
- Changes the user’s state to active.
- Consumes a subscription seat.
Block and unblock users
GitLab administrators can block and unblock users.
Block a user
Prerequisite:
- You must be an administrator for the instance.
You can block a user’s access to the instance. When you block a user, they receive an email notification that their account has been blocked. After this email, they no longer receive notifications. A blocked user:
- Cannot sign in or access any repositories, but all of their data remains in those repositories.
- Cannot use slash commands. For more information, see slash commands.
- Does not occupy a seat. For more information, see billable users.
To block a user:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- For the user you want to block, select the vertical ellipsis (), then Block.
To report abuse from other users, see report abuse. For more information on abuse reports in the Admin area, see resolving abuse reports.
Unblock a user
A blocked user can be unblocked from the Admin Area. To do this:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- Select the Blocked tab.
- For the user you want to unblock, select the vertical ellipsis (), then Unblock.
The user’s state is set to active and they consume a seat.
The unblock option may be unavailable for LDAP users. To enable the unblock option, the LDAP identity first needs to be deleted:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- Select the Blocked tab.
- Select a user.
- Select the Identities tab.
- Find the LDAP provider and select Delete.
Activate and deactivate users
GitLab administrators can deactivate and activate users.
Deactivate a user
Introduced in GitLab 12.4.
You can temporarily deactivate a user who has no recent activity.
The user you deactivate must be dormant. When you deactivate a user, their projects, group, and history remain. A deactivated user:
- Cannot access repositories or the API.
- Cannot use slash commands. For more information, see slash commands.
- Does not occupy a seat. For more information, see billable users.
Deactivation is similar to blocking, but there are a few important differences. Deactivating a user does not prohibit the user from signing into the GitLab UI. A deactivated user can become active again by signing in.
To deactivate a user from the Admin Area:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- For the user you want to deactivate, select the vertical ellipsis () and then Deactivate.
- On the dialog, select Deactivate.
Email notifications stop after deactivation. GitLab sends email notifications to users when their account has been deactivated. For more information about this feature, see user deactivation emails.
To deactivate users with the GitLab API, see deactivate user. For information about permanent user restrictions, see block and unblock users.
Automatically deactivate dormant users
- Introduced in GitLab 14.0.
- Exclusion of GitLab generate bots introduced in GitLab 14.5
- Customizable time period introduced in GitLab 15.4
- The lower limit for inactive period set to 90 days introduced in GitLab 15.5
Administrators can enable automatic deactivation of users who either:
- Were created more than a week ago and have not signed in.
- Have no activity for a specified period of time (default and minimum is 90 days).
To do this:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Settings > General.
- Expand the Account and limit section.
- Under Dormant users, check Deactivate dormant users after a period of inactivity.
- Under Days of inactivity before deactivation, enter the number of days before deactivation. Minimum value is 90 days.
- Select Save changes.
When this feature is enabled, GitLab runs a job once a day to deactivate the dormant users.
A maximum of 100,000 users can be deactivated per day.
Automatically delete unconfirmed users
-
Introduced in GitLab 16.1 with a flag named
delete_unconfirmed_users_setting
. Disabled by default. - Enabled by default in GitLab 16.2.
Prerequisites:
- You must be an administrator.
You can enable automatic deletion of users who both:
- Never confirmed their email address.
- Signed up for GitLab more than a specified number of days in the past.
You can configure these settings using either the Settings API or in a Rails console:
Gitlab::CurrentSettings.update(delete_unconfirmed_users: true)
Gitlab::CurrentSettings.update(unconfirmed_users_delete_after_days: 365)
When the delete_unconfirmed_users
setting is enabled, GitLab runs a job once an hour to delete the unconfirmed users.
The job only deletes users who signed up more than unconfirmed_users_delete_after_days
days in the past.
This job only runs when the email_confirmation_setting
is set to soft
or hard
.
A maximum of 240,000 users can be deleted per day.
Activate a user
Introduced in GitLab 12.4.
A deactivated user can be activated from the Admin Area.
To do this:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- Select the Deactivated tab.
- For the user you want to activate, select the vertical ellipsis (), then Activate.
The user’s state is set to active and they consume a seat.
Ban and unban users
-
Introduced in GitLab 14.2 with a flag named
ban_user_feature_flag
. Disabled by default. - Ban and unban users generally available in GitLab 14.8. Feature flag
ban_user_feature_flag
removed. - Hiding merge requests of banned users introduced in GitLab 15.8 with a flag named
hide_merge_requests_from_banned_users
. Disabled by default. - Hiding comments of banned users introduced in GitLab 15.11 with a flag named
hidden_notes
. Disabled by default. - Hiding projects of banned users introduced in GitLab 16.2 with a flag named
hide_projects_of_banned_users
. Disabled by default.
GitLab administrators can ban and unban users. Banned users are blocked, and their projects, issues, merge requests, and comments are hidden.
Ban a user
To block a user and hide their contributions, administrators can ban the user.
Users can be banned using the Admin Area. To do this:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- For the user you want to ban, select the vertical ellipsis (), then Ban user.
The banned user does not consume a seat.
Unban a user
A banned user can be unbanned using the Admin Area. To do this:
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- Select the Banned tab.
- For the user you want to unban, select the vertical ellipsis (), then Unban user.
The user’s state is set to active and they consume a seat.
Delete a user
Use the Admin Area to delete users.
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- For the user you want to delete, select the vertical ellipsis (), then Delete user.
- Type the username.
- Select Delete user.
You can also delete a user and their contributions, such as merge requests, issues, and groups of which they are the only group owner.
- On the left sidebar, select Search or go to.
- Select Admin Area.
- Select Overview > Users.
- For the user you want to delete, select the vertical ellipsis (), then Delete user and contributions.
- Type the username.
- Select Delete user and contributions.
Troubleshooting
When moderating users, you may need to perform bulk actions on them based on certain conditions. The following rails console scripts show some examples of this. You may start a rails console session and use scripts similar to the following:
Deactivate users that have no recent activity
Administrators can deactivate users that have no recent activity.
days_inactive = 90
inactive_users = User.active.where("last_activity_on <= ?", days_inactive.days.ago)
inactive_users.each do |user|
puts "user '#{user.username}': #{user.last_activity_on}"
user.deactivate!
end
Block users that have no recent activity
Administrators can block users that have no recent activity.
days_inactive = 90
inactive_users = User.active.where("last_activity_on <= ?", days_inactive.days.ago)
inactive_users.each do |user|
puts "user '#{user.username}': #{user.last_activity_on}"
user.block!
end
Block or delete users that have no projects or groups
Administrators can block or delete users that have no projects or groups.
users = User.where('id NOT IN (select distinct(user_id) from project_authorizations)')
# How many users are removed?
users.count
# If that count looks sane:
# You can either block the users:
users.each { |user| user.blocked? ? nil : user.block! }
# Or you can delete them:
# need 'current user' (your user) for auditing purposes
current_user = User.find_by(username: '<your username>')
users.each do |user|
DeleteUserWorker.perform_async(current_user.id, user.id)
end