Feature Request: Add a reversible user suspension option

Overview of the Feature Request

Add a reversible way for administrators to temporarily suspend a Dataverse user account without permanently deactivating it.

Dataverse currently supports user deactivation, but deactivation is intentionally irreversible and removes several aspects of the user's current access, including role assignments and group memberships. This works well when an account should be permanently disabled, but it leaves no supported option for temporary administrative suspension or for cases where an account may need to be restored later (e.g., a student left an institution but came back to be a faculty member).

A separate reversible Suspend User function could address this use case while preserving the existing meaning and behaviour of Deactivate User.

What kind of user is the feature intended for?

Superuser, Sysadmin

What inspired the request?

There has also been community discussion where an account was manually re-enabled through direct database changes, but this is not a supported administrative workflow and does not necessarily restore role assignments, group memberships, or other state removed during deactivation.

For repository administrators, there are situations where access may need to be disabled temporarily or where an administrator may deactivate an account in error. In these cases, permanent deactivation is a stronger action than necessary.

Related community discussion:
https://groups.google.com/g/dataverse-community/c/Cb13Gfze3ho/m/WH7ZOiyaDwAJ

What existing behavior do you want changed?

The existing Deactivate User behaviour does not necessarily need to change. It can remain a permanent administrative action for accounts that should no longer have access to the repository.

However, administrators currently have no supported reversible alternative when they only need to temporarily prevent a user from logging in or using API access.
The existing Deactivate User behaviour does not necessarily need to change. It can remain a permanent administrative action for accounts that should no longer have access to the repository.

However, administrators currently have no supported reversible alternative when they only need to temporarily prevent a user from logging in or using API access.

Any brand new behavior do you want to add to Dataverse?

Add a separate Suspend User / Reactivate User workflow.

For example, suspension could:

• prevent the user from logging in;
• disable API access while the account is suspended;
• preserve existing role assignments and group memberships;
• preserve dataset/file provenance and activity history;
• allow a superuser to reactivate the account later and restore access without reconstructing the user's previous permissions manually.

This would distinguish two administrative actions:

Suspend

• Temporary and reversible
• Blocks account access
• Preserves roles and group memberships

Deactivate

• Permanent
• Retains the current deactivation behaviour, including cleanup of access and permissions

This could also reduce the risk associated with accidentally deactivating the wrong account.

Any open or closed issues related to this feature request?

#2419 – User account cannot be disabled/deactivated
#4475 – Delete user via API
PR #7629 – Implementation of user deactivation

Are you thinking about creating a pull request for this feature?
no, not currently.

Start by reviewing PR #7629, which implemented the existing user deactivation behavior, along with related issues #2419 and #4475. The issue names no files or tests, so trace the current login, API access, role, and group-membership handling before defining the suspend and reactivate workflow; done means temporary access blocking with preserved state and reversible restoration.