Hi Alessandro,
I am facing a strange behavior. We have a mitigated user. I have removed the backend role expecting that the "invalid mitigation controls" report shows the result as mentioned by you. Do you have an idea what is the problem? May I need to run some synch jobs before?
The "mitigation controls" still shows the control assignment which is no more rigth.
Best regards Nguyen