Introducing User Inactivity Tracking

Overview

Maintaining tight access controls is essential in environments that handle sensitive or regulated data. To support this, Tyler Data & Insights now offers User Inactivity Tracking, a tool designed to help administrators detect and act on dormant user accounts. This promotes stronger access hygiene, aligns with best practices for regulated environments, and reduces the risk of unused credentials becoming a liability.

In addition to supporting access control, this feature can also help organizations manage user license counts. If your domain has a limited number of user seats, User Inactivity Tracking can identify accounts that are no longer being used, enabling administrators to reclaim and reassign those licenses as needed. This ensures your user allocation reflects active usage and helps maximize the value of your licensed seats.

How It Works

Enabling User Inactivity Tracking

User Activity Tracking is optional and enabled at the domain level.

To turn it on, navigate to the new User Activity Settings tab under Admin > Users (& Teams)

Only Open Data Portal Administrators and users on the Enterprise Data Platform with the “Add, remove, and manage users” permission can interact with and configure User Activity settings.

How Inactivity Is Measured

Once enabled, you can set an inactivity threshold (in days). This tells the system how many days without activity should be considered “inactive.”

User activity is based on authentication events, such as logging in through the website or accessing the system via APIs. The system records the most recent authentication timestamp once per day.

Inactivity tracking applies only to users with an assigned role. On Open Data Portal domains, community users are not included.

What Happens When You Turn It On

When you turn on User Inactivity Tracking, the system starts counting from today. No users are notified or logged right away.

From that point on, users who become inactive (based on your threshold) will be logged or notified.

Starting from today helps prevent a flood of emails or activity logs for users who were already inactive for a long time.

If you turn the feature off and back on again, tracking will restart from the new enable date.

Changing the threshold value does not affect this date.

Before turning on this feature, we recommend that admins review their users in Admin > Users:

• Sort by Last Signed In
• Take any needed action on existing inactive accounts
• Optionally, export your users for further review

Notification Options

You can choose to send an email to users when they become inactive. The email simply says they have become inactive and asks them to log in to keep their account active.

Admins can also set their own Notifications and Alerts to be notified when a user becomes inactive. The admin alert includes the user’s name, last login, and a link to manage the user in Admin > Users (or Users & Teams).

What Happens When A User Becomes Inactive?

When a user has not logged in for the configured threshold:

1. An ‘User Inactive’ event is logged in the Activity Log

   

2. Optionally, the user is alerted via email
   • If configured to send an email to the user, an email is sent once to the user per inactive period.
     • The email notifies them and informs them that they may lose access if they do not log in.
     • If they were to log in, the period would reset. They are not alerted multiple times per inactive period.
     • This alert is immutable by the user and only configurable at the admin level via Admin > Users & Teams > User Activity Settings
       
       A Sample email for when a user becomes inactive
3. Optionally, an admin who has configured their own Notifications and Alerts settings is alerted via email
   1. The email notifies them about the user that has become inactive and has links to manage this user on the platform.
      1. From the Admin > Users & Teams screen, the admin can change the users role, disable them, or take other action that your access policy dictates.
         
         A sample digest for administrators providing notice on users who have become inactive

Why It Matters?

Tracking inactivity supports strong access controls. Many security and compliance standards require organizations to limit access based on need-to-know and remove or disable user accounts when access is no longer necessary. Frameworks like HIPAA, CJIS, NIST 800-53, ISO 27001, and CMMC emphasize the importance of managing inactive users to reduce risk and maintain audit readiness. Inactivity tracking helps enforce these controls by identifying dormant accounts and prompting timely administrative action.

Additionally, for organizations managing a limited pool of user licenses, this feature can be a valuable tool for auditing active usage. By identifying and reclaiming accounts that are no longer in use, administrators can better allocate user seats and ensure that each license is assigned to an active user contributing to the system.

Additional Notes

• Inactivity-based user emails are automatically triggered and cannot be customized or disabled by users. Admins configure this at a domain level.
• Alerts sent to users are one-time reminders, not repeated.
• This feature is especially beneficial in regulated data environments and helps satisfy compliance requirements.