FortiDLP
FortiDLP is a cloud-native endpoint DLP and Insider Risk Solution which is aimed at monitoring and Preventing Data Theft on the endpoint, across Windows, macOS and Linux.
MIVES
Staff
Staff
Article Id 426577
Description This article describes how to delete operator accounts that have been removed from an external authentication source (such as FortiCloud) within the FortiDLP console.
Scope FortiDLP.
Solution

When an operator has been removed from an external authentication source (such as FortiCloud or MSSP), the operator will no longer be able to log into the FortiDLP console, but their operator account will remain in the list in the Admin Settings -> Operators page:

 

1b.png

 

This record is kept for auditing purposes, so the UUID of the operator can be linked to any audit log records. However, if it is preferable to delete this operator from this page, then this can be done via the API endpoint '/api/v2/global-operators'.

First, a GET request to the endpoint '/api/v2/global-operators/search' must be made (with an optional filter to narrow down the results) to obtain the UUID of the operator:

 

2.png

 

This value can now be used in a DELETE request to the endpoint '/api/v2/global-operators', which will delete the operator:

 

3.png

 

The operator will now be deleted.