There is currently no clean way to remove users out of the system automatically if a staff member leaves, changes roles etc.

Can we please have this investigated.

Solutions could include a admin set time based control (User hasn't logged in within 30/90/120/365 days, so deleted) or some kind of poll to the IDP (Does user account still exist yes/no)