Does disabling 'ArcGIS login' prevent Python from using built-in accounts?

Question

I was advised that if we disable "ArcGIS login" in the Security settings of ArcGIS Enterprise Portal that we would still be able to programmatically used built-in accounts.  In other words disabling that setting would remove the ArcGIS login option from the login page, but would not actually disable the built-in accounts.

However, when using the ArcGIS Python API, code that connects using a built-in account stops working when we disable that setting.

Was I given bad advice, or is there some trick to getting the Python API to connect when that setting is disabled?

We really don't want users to see that option for logging in because we get help tickets all the time when they chose that option instead of the button for Single Sign on.   Disabling that option makes a better user experience, but we still need back end Python jobs to be able to log in too.

JonathanDandois · Answer

Wooooo! Thank you for the follow-up @MichaelJenkins this worked for me. One thing though, with use_gen_token you can't use profile kwarg, which i guess makes sense as you are requiring it to get a new token each time, but this really helps with scripts that don't rely on SAML.

MichaelJenkins · Answer

In case anyone has the same question and finds this post, here is the answer.  Yes, you can disable "ArcGIS Login" so users do not have the ability to log in that way and still use a built-in account for back end Python scripts.

The key is to add an argument to the connection line that forces it to use a token instead of OAuth.

arcgis.gis module | ArcGIS API for Python

use_gen_token

Optional Boolean. The default is False. Uses generateToken login over OAuth2 login.

success.png