Quick question - trashed users are unable to authenticate? When somebody leaves, we move their account into trash. Just had a thought that this doesn’t actually disable authentication.
Users that are moved to the trash will be automatically and permanently deleted after 7 days and will no longer be able to authenticate with Duo at that point. They could authenticate in that 7 day window of “pending deletion” status before they are permanently deleted. If you want to permanently delete users and prevent them from authenticating immediately, you can do that in the Trash page of the admin panel following the directions in this help article.
I hope this helps! For more information, check out our documentation on deleting and restoring users.