Outcome
By the end of this lesson, you will be able to resolve principals with missing emails, explain why imported teams may arrive empty, and rely on idempotent re-import and clean disconnect.
| Prerequisites | M4.9.L3 |
| Time | 9 minutes |
1. Concept
Three operational facts make import usable as a repeatable process rather than a one-shot migration.
Missing emails
An email is how ZopNight identifies a person. Cloud principals do not always carry one.
AWS IAM users frequently have no email attributeGCP service accounts have no human email by definitionAzure AD principals usually do carry oneRESOLUTION Fill the missing emails, ONE BY ONE or BY CSV, and re-Apply.
The CSV path is what makes a 200-principal importtractable: export the list, join it against your HRdirectory or identity provider, upload.The principals stay in the proposal while their emails are missing. They are not dropped, so nothing is silently lost between passes.
Imported teams may arrive empty
This one surprises people and the cause is a permission you probably did not grant.
IMPORTED TEAMS ARRIVE WITH MEMBERS ONLY WHEN THE OPTIONALGROUP-READ GRANT IS PRESENT:
GCP Cloud Identity Azure Microsoft Graph
WITHOUT IT, the teams import as EMPTY SHELLS: the groupexists, its membership does not.Reading a group’s existence and reading its membership are different permissions on both platforms, and the group-read grant is optional precisely because it is a wider read than cost management needs. So the default import gets you team structure without team membership.
THE DECISION THIS FORCES EITHER grant the group-read scope and re-import, so teams arrive populated OR accept empty teams and assign members by hand
For a small number of teams, by hand is often fasterthan getting a wider directory read approved.Empty teams are worth spotting early, because an empty team in ZopNight is a showback dimension that attributes nothing, and it will look like a coverage problem later rather than a permissions one.
Re-import is idempotent
RUNNING IT AGAIN DOES NOT DUPLICATE ANYTHING.
The same principals resolve to the same ZopNightentities, so a second pass reconciles rather thanre-creating.This is what makes staged adoption safe, and it is the reason L1 recommends filtering your first apply to one or two teams. You are not committing to a big-bang migration; you are running the first slice of something you will run again.
It also makes import a reconciliation tool rather than only an onboarding one: run it quarterly and it will show you the drift between your cloud access model and your ZopNight one.
Disconnect removes what was imported
DISCONNECTING A CLOUD ACCOUNT CLEANLY REMOVES EVERYTHINGIMPORTED FROM THAT ACCOUNT.That is a stronger guarantee than it sounds, and it is what makes a trial import low-risk: you can import, look at the result, decide it is not what you wanted, and disconnect without leaving residue.
The scoping matters: it removes what came from that account. A user who also exists independently, or who was imported from a second account, is not removed by disconnecting the first.
Putting it together as a process
QUARTERLY IMPORT REVIEW
1. Re-import each connected account. 2. Compare the proposal with your current ZopNight member list. The import lists only who is in cloud IAM today; it does not show who was removed, so this comparison is done by hand. in the proposal, not in ZopNight -> people who joined in ZopNight, not in the proposal -> people who left, and whose ZopNight access may still exist proposed role differs from ZopNight -> cloud access that moved 3. Work Needs Attention for the new entries only. 4. Apply.
The "in ZopNight, not in the proposal" list is thevaluable one. It is a leavers check built from yourcloud IAM, and most orgs do not otherwise have onepointed at their cost platform.2. Demo
A second import, three months after the first:
FIRST IMPORT (Q1): 38 users, 7 teams, 6 roles applied
SECOND IMPORT (Q2), same account proposed users 42 needs attention 4
COMPARING THE PROPOSAL WITH THE MEMBER LIST (BY HAND)
IN THE PROPOSAL, NOT IN ZOPNIGHT 9 principals 7 joiners with matching HR records -> applied 2 with no email -> CSV fill, re-applied
UNCHANGED 30 principals Idempotent. No duplicates, no churn. The second apply reconciled them and changed nothing.
IN ZOPNIGHT, NOT IN THE PROPOSAL 5 principals THE VALUABLE LINE. 5 people had left the company. Their cloud access was removed during offboarding. Their ZOPNIGHT access was not: offboarding did not know ZopNight existed.
Two of the five still had Editor. One had been gone four months.
CHANGED ROLE 3 principals 2 promoted in cloud, reviewed and left at Editor in ZopNight (their new cloud scope was infrastructure, not cost) 1 moved teams -> team membership updated
TEAM MEMBERSHIP 7 teams still empty from Q1: the group-read grant was never approved.
DECISION AT Q2: 7 teams, ~40 people. Assigning by hand was quicker than another security review for a directory-wide read scope. Assigned by hand, closed the request.
WHAT THE QUARTERLY CADENCE ACTUALLY BOUGHT Not the joiners: those would have been noticed. The LEAVERS. Five stale accounts on a cost platform, found by an import nobody ran for that purpose.3. Hands-on (6 min)
1. Run an import on an account you imported before (or run one twice). Did anything duplicate? Y / N (It should not. Re-import is idempotent.)
2. How many proposed principals have no email? ______ Which path is faster for that number? [ ] one by one [ ] CSV
3. Check your imported teams. How many are EMPTY? ______ If any, do you have the group-read grant? GCP Cloud Identity / Azure Graph: Y / N Decide: grant it, or assign by hand? ____________
4. Compare the proposal against your CURRENT ZopNight user list. Who exists in ZopNight but no longer exists in cloud IAM? ______________________________________________ That is your leavers list. Act on it.
5. Confirm the disconnect story: if you disconnected this account, what would remain? ______________________________________________4. Knowledge check
Q1
Imported teams arrive with no members. The most likely cause:
A. The teams were empty in the cloud
B. Members were filtered out during translation
C. Team membership is assigned separately by design
D. The optional group-read grant is absent
Show answer
Correct: D. Reading a group’s existence and reading its membership are different permissions, and the group-read scope (Cloud Identity on GCP, Microsoft Graph on Azure) is optional because it is a wider read than cost management needs. Worth spotting early: an empty team in ZopNight is a showback dimension that attributes nothing, and three months later it will look like a tag-coverage problem rather than a permissions decision.
Q2
When you compare a quarterly re-import with your ZopNight member list by hand, which list is the most valuable?
A. New principals, showing who has just joined
B. The total count, showing the overall growth
C. People still in ZopNight who are no longer in the proposal
D. Roles that have changed in the cloud since
Show answer
Correct: C. Those are usually leavers whose cloud access was removed during offboarding while their ZopNight access was not, because offboarding did not know ZopNight existed. Most orgs have no other leavers report pointed at their cost platform. Joiners get noticed because someone asks for access. Leavers are silent, which is exactly why an import run for onboarding purposes turns out to be a useful access review.
Q3
Disconnecting a cloud account after an import:
A. Cleanly removes everything imported from that account, which is what makes a trial import low-risk
B. Leaves the imported users, teams and roles in place and completely untouched afterwards
C. Requires manually deleting every imported user first, one by one by hand
D. Is blocked for as long as any imported users still exist in the organisation
Show answer
Correct: A. The scoping matters: a user who also exists independently, or who was imported from a second account, is not removed. Combined with idempotent re-import, this is what lets you treat import as something to try rather than something to commit to: import, review the result, and disconnect without residue if it is not what you wanted.
5. Apply
Put a quarterly re-import in your access-review calendar, and compare the proposal with your ZopNight member list by hand, because the import does not show who was removed. The leavers list (people in ZopNight who are no longer in the proposal) is the one that justifies the cadence, and the re-import itself costs you nothing because it is idempotent.
If your teams imported empty, decide the group-read question deliberately rather than leaving empty teams sitting in your showback dimensions.
Related lessons
- L3: The org-management exclusion
- L1: Suggestions, never grants
- T4.M4.5.L2: Team attribution and shared resources
- T4.M4.3.L4: Audit as compliance evidence