We use Ansible to create users with this task:

```
- name: Create adm users
  user:
    name: "{{ item.name }}"
    group: "{{ common_adm_group }}"
    createhome: yes
    password: "!!"
    update_password: always
    state: present
  with_items: "{{ common_adm_users }}"

```

And common\_adm\_users is like this:

```
  - name: user1
    comment: "First Last"
    ssh_key: "ssh-rsa AAAAB3Nza..."

```

This works fine for creating users, but when someone leaves the team, just removing their user from common\_adm\_users doesn't cause it to be removed from the servers when we re-apply the role that includes this task.

What is the best practice to maintain an exact list of users?