Issue

When a user's account is marked as inactive, blocked, or the user's password is changed by an administrator through the User Access Management functionality, the user can still access application functionalities if they remain logged in. The user is not immediately kicked out from their active session when their account status is changed.

Environment

Studio Pro (all versions)

Cause

This is the expected behavior of the Mendix platform. When a user's account is deactivated, blocked, or their password is changed, the system does not automatically terminate existing active sessions. The account status changes only prevent new login attempts, but do not affect sessions that were already established before the account modification.

Solution / Workaround

Add logic that automatically deletes any active sessions associated with a user when their account status is changed. This ensures that deactivating a user immediately terminates their access to the application.

Additional information

Not Applicable