Organization audit
Public items with fields that look like personal data, users with no login for N days, unused licenses (stale_entitlement_usage) and credit consumption in ArcGIS Online, always with the same criteria.
Octo for ArcGIS Enterprise and ArcGIS Online
The whole organization, audited by script. The administrator decides.
Almost everything done in Portal for ArcGIS, ArcGIS Server and ArcGIS Online has a command-line path: ArcGIS API for Python, administration REST APIs, silent installation, WebGISDR, Chef, PowerShell DSC and Kubernetes scripts. With a read-only account or an approved staging environment, Octo can audit, prepare migrations and test restores with evidence. Publishing to production, changing permissions, deleting and restoring production stay with authorized people.
ArcGIS Enterprise, current version12.1released May 21, 2026 (Esri lifecycle)
Enterprise 12.0 retires onDec 12026; extended support until November 30, 2026
ArcGIS API for Python2.4.4PyPI, October 20, 2026; Python 3.11 to 3.14
Sources15listed at the end of the page
01
What Octo does in administration.
Six possible deliverables, drawn from the survey. All of them start from read-only access or an approved staging environment; none of them changes production, and all go to the administrator for review.
Migration with verification
Dependency inventory, service remapping, clone_items into a staging folder and item-by-item comparison: type, title, records per layer and URLs left over from the source.
Restore test
Backup with WebGISDR, restore into an isolated staging environment and automatic validation: output JSON, SEVERE errors in the Server log and comparison with the production manifest.
Deliverable: OK or mismatch report and actual restore timeInstallation and upgrade prepared
Silent installation commands, Kubernetes properties files, Chef recipes or DSC configurations, and the list of known blockers for the target version.
Deliverable: installation or upgrade runbook for reviewLog reading
Queries to logs/query in Portal and Server and to the organization history, to summarize what changed after an upgrade, a publication or an incident.
Deployment documentation
Versions, URLs, federated servers, data stores, backup routines and lifecycle deadlines, in a record the next job consults before acting.
Deliverable: updated deployment sheet
02
Eight arms, one organization.
The same Octo cycle, applied to ArcGIS administration. Each arm has a narrow role; the authorized administrator is the one who changes production.
-
Discovery
Maps the deployment
Enterprise version or Online organization, federated servers, data stores, Web Adaptor, content directory type, backup routines and the lifecycle deadline of the installed version.
-
Data
Understands the content
Which items, layers and groups exist, who owns what, which services are referenced and which are hosted. Counts and field names, never the content of the features.
-
Security
Asks for read-only
An account without edit privileges, password in the keyring or the client's vault, nothing in a permanent file. Personal data (LGPD) and confidential data are assessed with the client before going to any external service, including AI.
-
Architecture
Picks the path
Python API for content and users; REST API for logs and machines; WebGISDR for backup; Chef, DSC or Kubernetes scripts for deployment. Staging before anything that writes.
-
Development
Writes the script
Python and shell scripts with the Esri documentation cited in the file itself, environment safeguards and CSV or JSON output that someone else can check.
-
Review
Checks by the result
Compares counts, reads the WebGISDR JSON, looks for SEVERE in the log. A script that finished without errors proves nothing; the verification report does.
-
Release
Delivers for decision
Only with your OK, it runs in the approved staging environment and leaves reports and runbooks for the administrator. Repeating it in production is their decision and action.
-
Documentation
Records what holds in your deployment
Versions, URLs, data stores, audit criteria and actual restore time. The next job starts from this record and checks whether it still holds.
Octo does not publish to production, change permissions, delete users or content, or restore production. That belongs to the client's authorized administrator.
03
Each task, its path.
The criteria Octo uses to choose. Every path is documented by Esri; what was not confirmed is flagged in the survey.
| Task | Path | Note |
|---|---|---|
| Public items and suspicious fields | gis.content.search("access:public") + fields of each layer | Screening by name; decision with the data protection officer |
| Inactive users and idle licenses | lastLogin + gis.admin.license.stale_entitlement_usage | Deactivating and revoking stay with the administrator |
| Credit consumption | gis.admin.credits.credit_usage | ArcGIS Online only |
| Server errors over a time range | admin/logs/query with level=SEVERE | Token via generateToken; up to 10,000 per page |
| Headless installation on Linux | ./Setup -m silent -l yes -a <.prvc> | Installation folder in lowercase |
| Deploying to several machines | Chef (Linux and Windows) or PowerShell DSC (Windows) | Esri repositories, Apache 2.0 |
| Deploying on Kubernetes | deploy.sh -f deploy.properties and configure.sh | Passwords encrypted with password-encrypt |
| Deployment backup | webgisdr --export --file <props> --output <json> | Tile caches and referenced data handled separately |
| Testing a restore | webgisdr --import in isolated staging + validation | Same version, same URLs, same operating system |
| Migrating from Online to Enterprise | clone_items(..., item_mapping=...) + verification | Items and URLs checked after cloning |
04
From audit to routine.
Three steps. Each one only makes sense after the previous one has shown results in your organization.
A proposal, not a promise
On-demand audit
With a read-only account, you ask in administrator terms and Octo proposes the script and the report.
- “What is public with a CPF?” becomes a list with owner and count
- Inactive users cross-checked with paid licenses
- Server errors from the last week, by service
Migrations and upgrades with evidence
Big changes go through staging first, with a verification report before any step in production.
- Online migration with remapping and item-by-item verification
- Upgrade runbook with known blockers for the version
- Lifecycle deadlines tracked (12.0 retires December 1, 2026)
Recovery tested as routine
The restore test is no longer postponed and runs on the agreed schedule, with the actual time measured.
- Export, restore in staging and automatic validation
- Monthly audit with the same criteria
- Deployment sheet updated each cycle
05
Confirmed by source.
Each point below has a source published by the vendor, the project or the responsible agency. The sources are in the next section.
3
points with a published source, each with its reference alongside.
- ConfirmedVersion lifecycle
- ArcGIS Enterprise 12.1 released May 21, 2026. 12.0, a short-term release, leaves extended support on November 30, 2026 and retires on December 1, 2026. 11.5 is the most recent LTS and retires on June 1, 2031.Source: ArcGIS Enterprise lifecycle page, Esri
- ConfirmedWebGISDR: what it restores and what it requires
- Exports and imports Portal, federated servers and Data Store, with JSON output per component. Source and target must have the same version, the same organization URL and the same service URLs; tile caches, referenced data and the spatiotemporal big data store are left out.Source: ArcGIS Enterprise 12.1 backup and restore documentation, Esri
- ConfirmedPython API and deployment automation
- Package
arcgis2.4.4 on PyPI on October 20, 2026, for Python 3.11 to 3.14. Chef cookbooks v5.4.0 (June 4, 2026) with 12.1 support; PowerShell DSC v5.1.2 (September 8, 2026); both Apache 2.0.Source: PyPI; Esri repositories on GitHub
06
What Octo does and what stays with you.
Octo prepares everything, but does not sign. The document of record stays with whoever is accountable for it.
Octo prepares
Gathers, calculates, organizes and produces the documents: spreadsheets, reports, maps and drafts.
Deliverable: material ready for reviewYour team reviews
The licensed professional reviews what Octo delivered before signing. If something doesn't add up, it goes back to Octo with the correction.
Step: review by whoever signsWho signs
Octo does not sign. Designs, technical reports, ART/RRT, accountability reports and any official document are still signed by the licensed professional at the company or agency: here, the professional of record for the map or survey.
Signature: professional of record for the map or survey
07
Sources.
Esri documentation used in the research, accessed October 29, 2026.
- Esri: ArcGIS Enterprise lifecycleRelease and retirement dates
- What's new in ArcGIS Enterprise 12.1Metrics, Reports, version notices
- Backup and restore with WebGISDROverview and arguments
- WebGISDR properties fileProperties and modes
- Restoring ArcGIS EnterpriseSource and target requirements
- WebGISDR output fileJSON per component
- ArcGIS Server silent installationLinux
- ArcGIS API for Python: arcgis.gisGIS, content, users, clone_items
- ArcGIS API for Python: arcgis.gis.adminLicenses, credits, logs, webhooks
- PyPI: arcgisVersion 2.4.4, October 20, 2026
- Server Admin API: Query logsParameters and filters
- Server Admin API: Generate TokenAdministration token
- Esri: arcgis-cookbook (Chef)v5.4.0, June 4, 2026
- Esri: arcgis-powershell-dscv5.1.2, September 8, 2026
- Esri: Enterprise on Kubernetes resourcesDeployment guides
Your organization, checked before the decision.
The assessment starts with an audit using a read-only account, without changing anything in your Portal. You get the report and a proposal for what can be automated and tested, and decide with it in hand.