If a user or group no longer requires a specific set of permissions for a member account, you can remove the corresponding access assignment. This action revokes their ability to access the account by using that specific permission set.
Before you begin
When you remove an access assignment, the associated users or groups immediately lose the permissions granted by that assignment for the specified account.
Procedure
Log on to the CloudSSO console.
In the left-side navigation pane, choose Access Management.
On the Multi-account Permission Configuration page, find the account that you want to modify and click its name.
On the account's details page, click the Access Assignments tab.
Find the user or group from which you want to remove access, and click Remove Access Assignments in the Actions column.
In the Remove Access Assignments dialog box, a list of all permission sets assigned to that user or group for this account is displayed. Select the checkbox next to the specific access assignment that you want to remove.
Click OK to confirm the removal.
Result
The system begins de-provisioning the access. After the process is complete, the user or group can no longer use the removed permission set to access the member account.