A disabled user account that still holds security roles

Disabled user account still has security role assignments.

Disabling a user suspends login but keeps their roles. Re-enable the account, on purpose or through a directory sync, and every role snaps back with no further action.

List disabled users and link through systemuserroles. Any disabled account with rows returned is the finding. This one is genuinely quick to check and it appears in almost every environment older than a couple of years.

Strip roles during offboarding; re-grant on reactivation only after review.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A disabled user who still has records shared with them
• A flow or workflow owned by a disabled user
• A plugin step set to run as a disabled user
• A plugin step that always runs as the same named user