Creating Missing Users and Groups during Migration (Limited Availability)

During a migration, some users or groups referenced in the source system’s permissions may not yet exist on the Egnyte domain. Egnyte can identify these missing users and groups and create them during the migration, ensuring that their permissions are preserved and applied correctly instead of being skipped.

 

Key Terms

Direct Missing User

A direct missing user is a user who has permissions assigned to them directly on one or more folders in the source system, but does not yet exist on the Egnyte domain. These users are identified and flagged during Permission Migration.

Direct Missing Group

A direct missing group is a group that appears in the source system's folder permissions but does not yet exist on the Egnyte domain. Like direct missing users, these groups are flagged and reported during Permission Migration.

User Missing via Group Membership 

These are users who have access to a folder through group membership rather than through direct permissions. In such cases, only the group is flagged as missing, not the individual users.

For example, if the Payroll-Team group has access to the /Finance/Payroll folder and Sean, Irene, and Amit are members of Payroll-Team, but the group does not exist in Egnyte, only Payroll-Team is flagged as missing. Sean, Irene, and Amit are not reported as missing users because they do not have direct permissions on the folder.

Mapped Users and Groups

If a source user or group is already included in the Permission Mapping settings, it is not treated as a missing identity, even if the mapped destination user or group does not exist. These mappings are considered intentionally skipped and do not pause the permission migration process.

For example, if Permission Mapping includes the following mappings:

• Source User U1 → Destination User U001
• Source Group G1 → Destination Group G001

If destination user U001 and destination group G001 do not exist in Egnyte, they are considered intentionally skipped. As a result, source user U1 and source group G1 are excluded from the list of missing users and groups.

 

Steps to Create Accounts for Missing Users & Groups

1. Users can simulate permissions first and then migrate permissions or they may choose to migrate permissions directly. 
   • In both the scenarios, if the checkbox for Do you want to create accounts for missing users & groups on destination? is checked, the migration will pause and prompt the admins to add the details. 
   • Click on Migrate Permissions 

   • If the Permissions Migration is initiated after the Simulate permissions report, any missing users or groups identified in the previous run will be reported as missing, and the command will pause for a user action.

     
     

2. Click on Download list of missing users and groups found, fill the missing details, and click on Browse to select the updated CSV. Click on Upload. 
   • Alternatively, click on Proceed without uploading the CSV. In this case, migration will resume without creating any missing users or groups.
   • If the admins choose not to proceed, they can select the second radio button to abort the command or click on cancel. 
   • Once the CSV is accepted without errors, click Proceed to resume the migration. Users are created first, followed by groups. The migration then continues applying permissions as normal.
     
3. If the admins cancel or abort, no users or groups are created and nothing partial is left behind. The permissions command moves to a Failed state and the Permission Migration must be re-run from the beginning.

 

Completing the CSV File

The downloaded CSV contains two sections, one for users and one for groups. All required fields must be filled in for each identity before uploading.

Users Section

Each missing user entry in the CSV includes the following fields. 

• username: This field is pre-filled by Egnyte and must not be edited. It identifies the missing source user and is case-sensitive. The value accepts up to 64 characters including letters, numbers, hyphens, underscores, and periods. Each username must be unique within the file
• email: This field is required. Enter a valid email address that does not already exist on Egnyte. Each email address must be unique across all entries in the file
• first_name: This field is required. The value accepts up to 45 characters
• last_name: This field is required. The value accepts up to 45 characters

Groups Section

Each missing group entry in the CSV includes the following fields. 

• group_name: This field is pre-filled by Egnyte and must not be edited. It contains the source group name that was flagged as missing and is case-sensitive. Each entry must be unique within the file
• new_group_name: This field is required and is pre-filled with the same name as the source group. It can be updated to a different name if needed, for example to align with an Egnyte naming convention. Each new_group_name must be unique and cannot reuse the name of any existing source or destination group

Fix CSV Errors and Re-upload 

If there is a problem with the uploaded CSV, the migration will not proceed and an error message is displayed. 

There are two types of errors that may come up: 

• File format errors: These may include issues, such as missing column headers or an incorrect structure. The file structure must be corrected and re-uploaded. 
• Row-level errors: These would include issues, such as an invalid email address or a duplicate entry. A copy of the file can be downloaded using the same download list of missing users and groups found option with an added Error column that identifies exactly which rows need fixing. Those rows must be corrected before re-uploading the entire file. 

The CSV can be re-uploaded as many times as needed. Only the most recent successful upload is used when the migration proceeds.

 

Review Results

After the migration completes, the report can be reviewed to confirm which identities were created successfully and which were not. The report contains the following sheets: 

• Missing Users / Missing Groups: Lists all identities detected as missing during the migration scan. 
• Provisioned Users / Provisioned Groups: Located in the Permissions folder of the report. It shows the outcome of the creation attempt for each identity, including any that failed.

Report File Locations 

The provisioned identity reports are saved locally on the machine running the migration agent. The file paths are as follows: 

• Provisioned Users report: C:\Users\{username}\AppData\Local\egnyte-agent\{migrationID}\perms\provisioned_users_report_migrationID.csv 
• Provisioned Groups report: C:\Users\{username}\AppData\Local\egnyte-agent\{migrationID}\perms\provisioned_groups_ report_migrationID.csv

 

Key Points to Note

The following behaviors apply when using the Create Missing Users and Groups feature: 

• Mapped identities are not treated as missing. If a source user or group is already listed in the Permission Mapping even if the mapped destination does not exist on Egnyte, it will not be flagged as missing and will not trigger a pause. Its permissions will be marked as failed in the report. All Permission Mapping destinations should be verified to exist on the domain before running the migration.
• Each missing group must map to a unique destination name. No two missing groups can share the same destination group name. Only 1-to-1 group mappings are supported. A new group name cannot reuse the name of any existing source or destination group, to avoid conflicting permission mappings. 
• Source permission changes during the pause are not captured. All source permissions are scanned before the migration pauses. Any changes made to source permissions while the migration is paused will not be reflected when it resumes. 
• A group is still created even if some of its members fail. If some users within a group cannot be created, the group is still provisioned with the members that were successfully created. 
• There is no built-in limit on the number of identities that can be created. The feature does not enforce a limit on how many users or groups can be created in a single migration run. 
• Removing an identity from the CSV prevents it from triggering another pause. If a user or group is intentionally removed from the CSV while the migration is paused and the updated CSV is uploaded, the migration will not pause again for that identity when it resumes even if the identity is still missing on Egnyte. It will be skipped without any prompts.