Define what inactive means at each target
SCIM active is an administrative status whose exact meaning is determined by the service provider. It does not universally prove every existing session is revoked. The following local plan requires separate evidence for access, sessions and background jobs.
| Component | Desired state | Evidence |
|---|---|---|
| Account record U-15 | active=false | Target read confirms administrative state |
| Existing session | Policy-defined access denied | Protected test request is refused |
| Owned scheduled work | Transferred, paused or explicitly retained | Named operational decision |
Keep unresolved targets visible
Record desired revision, per-target result and retry owner. A successful update response is only one piece of evidence. Use the actual target documentation to test session expiry or revocation, and preserve business record ownership without granting the deactivated user access.
One target confirms inactive but still accepts a previously issued session. What remains open?
Show the worked answer
The session/access requirement remains unresolved. Apply the supported revocation or expiry path under the agreed policy and retest; do not claim complete deactivation from the account flag alone.