PCI audit The following list of Meraki Dashboard administrators is current and accurate.

[meraki-user]

PCI audit shows a failure on "The following list of Meraki Dashboard administrators is current and accurate." It is citing administrator accounts that have been deleted. Where is it seeing them, if they have been deleted? How can the list of administrators in the system be an inaccurate list?

[GreenMan]

Pretty sure this is referring to SAML login and is expected behaviour.   The listed accounts have been used historically to access the dashboard, so will still be visible there, even though they've been deleted at the IdP end.   While they are listed, they will not be able to login.
I believe such associations can be removed by toggling the enable / disable on that SSO.

[bwebb]

Why would this be expected behavior?  What happens when multiple organizations are managed by a single entity like an MSSP?  The MSSP has to go into every organization and disable/reenable their SSO instance for every client whenever an employee is removed?  What if an individual flips this between reports?  They can wipe the listed account's access?  That doesn't sound like a compliant report.

This can't be by design...this has to be a failure to address an obvious compliance reporting issue or how can Meraki PCI reports be relied upon to present accurate information?  Even if there were a way to mark out individual users as removed and a timer during which they would no longer show on reports...anything.  If I am missing something please let me know but saying it is expected behavior is very concerning.

[GreenMan]

The IdP is checked when an admin logs in, regardless.   If the user in question has been disabled at the IdP end, they won't gain access to the Meraki Dashboard.   It's not my area of in-depth expertise, but it seems pretty impractical to me for Dashboard to maintain a 100% sync with every single configured IdP.  Would forcing a sync before running a particular compliance check be particularly onerous?   If you have particular concerns, you're probably best advised to pick them up directly via your Meraki account team.

[meraki-user]

Forcing a sync sounds great. Is there any documentation on how this can be done?

[GreenMan]

Disable and enable the SSO in question   (Org > Settings > Authentication)