https://userapps.support.sap.com/sap/support/knowledge/en/3536733
3536733 - Agent Lifecycle Management: Single Sign-On is allowing inactivated users to access the...
A user has been deactivated in your ALM environment but is still able to log in through the Single Sign-On (SSO) link. This is expected behavior, and this...