We have a group who is trying to encourage more of their (very large) department to utilize Workfront for communication and collaboration. Most of the department's members don't currently have WF accounts. I think for the most part they're looking for comments and the occasional approval. Due to the...

Sandbox refreshes in our environment have to be approved by a governance board (it's a whole thing) so I haven't tested that.

In my case I created a test user in a sandbox environment and can't delete it. It never appeared in the Admin Console at all.

Wait, there's no longer a way to delete users?  So if I'm working on a Fusion automation that's triggered by new user creation, then my testing will result is potentially dozens of junk user accounts?

I work with OP and wanted to post the resolution. Turns out that Workfront is requesting a user certificate as part of the IDP authentication process. This means you have to disable SSL decryption. Adding *.workfront.com to our decryption bypass list on our firewalls fixed the problem. 

We already have. 

It's working!!!2 small caveats:1. I'm getting emails but still no in-app notifications. Not sure why.2. I had to use this to add a note to a task:"topNoteObjCode":"TASK", "topObjID":"{<object id>}", I can't thank you enough!

I will definitely try this, assuming a note can be attached to a task as opposed to a project. My scenario is currently creating an update on the task, but I like your solution much better.

So... there's a field called "Users Historical Decisions" that gives us data of how many approvals each user has made over the last 12 months. Neat! With the new licensing model, going above a certain threshold will kick a user from a free license to the "Light" license. We're going to be billed for...

It's working, except that the users are getting emails but no in-app notifications, which seems very odd to me.