usually you'd just check if a user was deactivated at the authn level