A disabled user who still has records shared with them

Disabled user account still holds manually shared records.

Disabling a user revokes neither roles nor record shares, and shares have no surface in the user UI, so they survive careful offboarding. Re-enable the account and the shared records are reachable again.

Manual shares live in the principalobjectaccess table, which has no user-interface surface at all. You need a direct query against it, filtered to disabled principals. The absence of any screen is exactly why this survives offboarding that otherwise went well.

Revoke manual shares alongside role removal, or reassign the records to a team.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for PS.L2-3.9.2 (Level 2: protect systems containing CUI during and after personnel actions such as termination), for the Dataverse system in your assessment scope. Record shares survive the disable that revokes sign-in, so the offboarding checklist reads as complete while the sharing table still names the person who left.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A disabled user account that still holds security roles
• A flow or workflow owned by a disabled user
• A Copilot Studio agent owned by a disabled user
• An AI Builder model or prompt owned by a disabled user