Your deployment may benefit from the new application-based assignments in App Volumes 4.
Assigning individuals is much more convenient using a (current) marker. With the marker, you won't need to re-assign them when you update your package. So in affect you can manage the "group" on the application's dashboard.
If you would prefer to still manage the assignments via an Active Directory group, there may be another option for you.
From what I gathered from your original post, ideally you would like the ability to disable a package for an existing user by creating a negative assignment of sorts.
Today when assigning an application, you can only choose the (current) marker or point to a specific package. Perhaps an option to select "no package" when assigning an application would be ideal.
I suppose that with the App Volumes 4 inventory, you could do something similar. Theoretically you could create a new "blank" package and assign it directly to the user instead of the group. Since only one package for a given application can be delivered to a user and user assignments will override group assignments, the user would get the "blank" package instead of the package thought to be causing the issue. While not ideal, this approach may potentially be of use when trying to find the bad actor.
This workaround aside, I will also take note of your suggestion.
Thank you for your feedback!
