We use a few custom scripts for managing users.
See AuthenticationScheme for background information.
create-user $USER creates a new "real" user (human being)
create-service-user $USER creates a new shared service user. Also see PrincipalsForNonHumans
freeze for freezing members that will have a negative balance soon (see MemberFreezing)
destroy-user $USER deactivates the user account, saving their volume for a later purge (or reactivation if they rejoin quickly)