Hi team, I'm wondering what would be your recommandation to disable practitioners that did not login for 1 year ? The idea is to disable the user so that the Practitioner that doesn't use the account cannot be hacked and no data can be leaked because of ghost accounts. My first though was to do something like a CRON job that would do the following : - Get all practitioner - Get all users associated to the Practitioner - For each user get the last Login I'm afraid that this can take quite some time if the database has a lot of Practitioners. So I'm wondering if there is a better way. Thank you !

Hi @thomabig , are you self hosting?

Hi @finnbergquist, Yes, we are self hosting.

I think your approach makes sense. No way to do it more efficiently. I'd suggest running it over night

Thank you @finnbergquist ! Quick question what's the best practice to disable an account so that the user cannot login anymore ? Is there a way to do that out of the box? I see that ProjectMembership has a "active" box, but as of today all of my Practitioners have ProjectMembership with active set to false and they still can access the app. Thanks !

I would recommend deleting the ProjectMembership but keeping the profile resource (Patient or Practitioner) as a record. If you reinvite at some point, it will link a new ProjectMembership to the existing profile.