Outcome
By the end of this lesson, you will be able to resolve principals with missing emails, explain why imported teams may arrive empty, and rely on idempotent re-import and clean disconnect.
| Tier | Architect |
| JTBD | ”Run this repeatedly as our cloud access model changes, without accumulating mess.” |
| Personas | Security/Compliance · Platform Engineer |
| Prerequisites | M3.9.L3 |
| Time | 9 minutes |
| Bloom verb | Resolve (Apply), Explain (Understand), Rely (Evaluate) |
1. Concept
Three operational facts make import usable as a repeatable process rather than a one-shot migration.
Missing emails
An email is how ZopNight identifies a person. Cloud principals do not always carry one.
AWS IAM users frequently have no email attributeGCP service accounts have no human email by definitionAzure AD principals usually do carry oneRESOLUTION Fill the missing emails, ONE BY ONE or BY CSV, and re-Apply.
The CSV path is what makes a 200-principal importtractable: export the list, join it against your HRdirectory or identity provider, upload.The principals stay in the proposal while their emails are missing. They are not dropped, so nothing is silently lost between passes.
Imported teams may arrive empty
This one surprises people and the cause is a permission you probably did not grant.
IMPORTED TEAMS ARRIVE WITH MEMBERS ONLY WHEN THE OPTIONALGROUP-READ GRANT IS PRESENT:
GCP Cloud Identity Azure Microsoft Graph
WITHOUT IT, the teams import as EMPTY SHELLS: the groupexists, its membership does not.Reading a group’s existence and reading its membership are different permissions on both platforms, and the group-read grant is optional precisely because it is a wider read than cost management needs. So the default import gets you team structure without team membership.
THE DECISION THIS FORCES EITHER grant the group-read scope and re-import, so teams arrive populated OR accept empty teams and assign members by hand
For a small number of teams, by hand is often fasterthan getting a wider directory read approved.Empty teams are worth spotting early, because an empty team in ZopNight is a showback dimension that attributes nothing, and it will look like a coverage problem later rather than a permissions one.
Re-import is idempotent
RUNNING IT AGAIN DOES NOT DUPLICATE ANYTHING.
The same principals resolve to the same ZopNightentities, so a second pass reconciles rather thanre-creating.This is what makes staged adoption safe, and it is the reason L1 recommends filtering your first apply to one or two teams. You are not committing to a big-bang migration; you are running the first slice of something you will run again.
It also makes import a reconciliation tool rather than only an onboarding one: run it quarterly and it will show you the drift between your cloud access model and your ZopNight one.
Disconnect removes what was imported
DISCONNECTING A CLOUD ACCOUNT CLEANLY REMOVES EVERYTHINGIMPORTED FROM THAT ACCOUNT.That is a stronger guarantee than it sounds, and it is what makes a trial import low-risk: you can import, look at the result, decide it is not what you wanted, and disconnect without leaving residue.
The scoping matters: it removes what came from that account. A user who also exists independently, or who was imported from a second account, is not removed by disconnecting the first.
Putting it together as a process
QUARTERLY IMPORT REVIEW
1. Re-import each connected account. 2. Read the DIFF, not the whole proposal. What is new since last quarter? new principals -> people who joined removed -> people who left, and whose ZopNight access may still exist changed roles -> cloud access that moved 3. Work Needs Attention for the new entries only. 4. Apply.
Step 2's "removed" line is the valuable one. It is aleavers report derived from your cloud IAM, and mostorgs do not otherwise have one pointed at their costplatform.2. Demo
A second import, three months after the first:
FIRST IMPORT (Q1): 38 users, 7 teams, 6 roles applied
SECOND IMPORT (Q2), same account proposed users 52 needs attention 4
READING THE DIFF RATHER THAN THE PROPOSAL
NEW since Q1 9 principals 7 joiners with matching HR records -> applied 2 with no email -> CSV fill, re-applied
UNCHANGED 38 principals Idempotent. No duplicates, no churn. The second apply reconciled them and changed nothing.
GONE from cloud IAM 5 principals THE VALUABLE LINE. 5 people had left the company. Their cloud access was removed during offboarding. Their ZOPNIGHT access was not: offboarding did not know ZopNight existed.
Two of the five still had Editor. One had been gone four months.
CHANGED ROLE 3 principals 2 promoted in cloud, reviewed and left at Editor in ZopNight (their new cloud scope was infrastructure, not cost) 1 moved teams -> team membership updated
TEAM MEMBERSHIP 7 teams still empty from Q1: the group-read grant was never approved.
DECISION AT Q2: 7 teams, ~40 people. Assigning by hand was quicker than another security review for a directory-wide read scope. Assigned by hand, closed the request.
WHAT THE QUARTERLY CADENCE ACTUALLY BOUGHT Not the joiners: those would have been noticed. The LEAVERS. Five stale accounts on a cost platform, found by an import nobody ran for that purpose.3. Hands-on (6 min)
1. Run an import on an account you imported before (or run one twice). Did anything duplicate? Y / N (It should not. Re-import is idempotent.)
2. How many proposed principals have no email? ______ Which path is faster for that number? [ ] one by one [ ] CSV
3. Check your imported teams. How many are EMPTY? ______ If any, do you have the group-read grant? GCP Cloud Identity / Azure Graph: Y / N Decide: grant it, or assign by hand? ____________
4. Compare the proposal against your CURRENT ZopNight user list. Who exists in ZopNight but no longer exists in cloud IAM? ______________________________________________ That is your leavers list. Act on it.
5. Confirm the disconnect story: if you disconnected this account, what would remain? ______________________________________________4. Knowledge check
Q1
Imported teams arrive with no members. The most likely cause:
A. The teams were empty in the cloud
B. Members were filtered out during translation
C. Team membership is assigned separately by design
D. The optional group-read grant is absent
Show answer
Correct: D. Reading a group’s existence and reading its membership are different permissions, and the group-read scope (Cloud Identity on GCP, Microsoft Graph on Azure) is optional because it is a wider read than cost management needs. Worth spotting early: an empty team in ZopNight is a showback dimension that attributes nothing, and three months later it will look like a tag-coverage problem rather than a permissions decision.
Q2
What is the most valuable line in a quarterly re-import diff?
A. New principals, showing who has just joined
B. The total count, showing the overall growth
C. Principals that have disappeared from cloud IAM
D. Roles that have changed in the cloud since
Show answer
Correct: C. Those are usually leavers whose cloud access was removed during offboarding while their ZopNight access was not, because offboarding did not know ZopNight existed. Most orgs have no other leavers report pointed at their cost platform. Joiners get noticed because someone asks for access. Leavers are silent, which is exactly why an import run for onboarding purposes turns out to be a useful access review.
Q3
Disconnecting a cloud account after an import:
A. Cleanly removes everything imported from that account, which is what makes a trial import low-risk
B. Leaves the imported users, teams and roles in place and completely untouched afterwards
C. Requires manually deleting every imported user first, one by one by hand
D. Is blocked for as long as any imported users still exist in the organisation
Show answer
Correct: A. The scoping matters: a user who also exists independently, or who was imported from a second account, is not removed. Combined with idempotent re-import, this is what lets you treat import as something to try rather than something to commit to: import, review the result, and disconnect without residue if it is not what you wanted.
5. Apply
Put a quarterly re-import in your access-review calendar, and read the diff rather than the proposal. The leavers line is the one that justifies the cadence, and it costs you nothing because re-import is idempotent.
If your teams imported empty, decide the group-read question deliberately rather than leaving empty teams sitting in your showback dimensions.
Related lessons
- L3: The org-management exclusion
- L1: Suggestions, never grants
- T3.M3.5.L2: Team attribution and shared resources
- T3.M3.3.L4: Audit as compliance evidence
Glossary terms touched
Idempotent import · Group-read grant · Cloud Identity · Leavers report