SCIM soft-delete disables the account in the app, but a nested group from a secondary directory sync still grants access through another route

Offboarding looks complete in the primary system, yet effective authorization still arrives from a parallel identity feed.