Docebo Mass User Deactivation: The Right Workflow and the Gotchas Most Admins Miss

Every organization eventually faces a round of "spring cleaning" — contractors who left, employees who churned, accounts that have been dormant for years. In Docebo, mass user deactivation seems simple enough: flip a status, done. In practice, there are several non-obvious behaviors that regularly catch experienced admins off guard.

Deactivate vs. Delete: Choose Carefully

First, the most important decision: deactivating a user preserves all their historical data — completions, certificates, scores, enrollment records — while making the account inactive. The user cannot log in, but everything they ever did in the platform remains intact for reporting and compliance purposes.

Deleting a user removes them and their data permanently. This is irreversible and almost always the wrong choice for anyone who has completed any training. Reserve deletion for accounts created in error or test users with no real activity.

For end-of-employment scenarios, deactivation is the correct path. Historical training records are typically required for compliance audits, and you cannot recover them after deletion.

The Critical Gotcha: Deactivation Does Not Unenroll

This is what catches admins most often: deactivating a user does not automatically unenroll them from courses or learning plans. A deactivated user can still appear as "Enrolled" or "In Progress" in your reports — which skews completion rate metrics and creates noise in manager dashboards.

The recommended approach before deactivating at scale:

Leave users enrolled in courses with status Completed — these records are part of their training history.
Unenroll them from any courses with status Enrolled or In Progress — these have no historical value and will inflate your "in progress" numbers indefinitely.
Handle unenrollment via the Course management area, Learning Plans area, or the API if doing it at scale.

The Right Method for Mass Deactivation

For deactivating large numbers of users efficiently, the most reliable approach is a CSV import via the Automation App:

Prepare your CSV: The file needs at minimum a username column and an active column set to no. Save as UTF-8 encoding — this is a frequent import failure point that has nothing to do with the data itself.
Set up an automation rule: In Admin > Automation, create a rule triggered by file upload to SFTP. Map the CSV fields to the corresponding user properties.
Test on a small batch first: Deactivation via automation does not have a built-in undo. If something goes wrong, you need to re-import with active = yes to reverse it. Test on 5–10 accounts before running hundreds.

If you are deactivating fewer than 250 users, you can also do it through the Users area in the Admin panel using mass actions (select users > Actions > Deactivate). For over 250 users, Docebo processes this as a background job.

Before You Deactivate: Clean Up Power User Roles

If any of the users you are deactivating hold Power User roles, downgrade them to regular User level first. A deactivated Power User can leave behind orphaned configurations — reports, groups, or automation rules that referenced their permissions. This is especially important if the Power User had visibility into branches or managed specific user groups.

Similarly, check if any departing users are configured as Direct Managers for other users. Those relationships should be reassigned before deactivation to avoid breaking manager-level notification rules and report visibility.

What Happens to the Data

Deactivated users remain fully visible in reports. Their historical enrollment data, scores, completion dates, and certificates are preserved and can be pulled in custom reports at any time. The account simply cannot be used to log in or receive new enrollments.

One important nuance: deactivated users still count against your license seats depending on your Docebo contract. If your organization is managing seat counts, confirm with your account team whether deactivated users are included in your billing calculation.

Expired vs. Deactivated: Not the Same Thing

Docebo offers two distinct inactive states that admins sometimes confuse:

Expired: A user whose account has passed the expiration date set on their profile. The account may or may not be able to log in depending on your platform settings. Expiration is useful for temporary access scenarios like contractors.
Deactivated: A user explicitly set to inactive status by an admin or via automation. Cannot log in regardless of any date settings.

For permanent departures, deactivation is the appropriate status. Expiration is better suited for time-limited access that you want to auto-manage.