Who added that user to the group? Security automation and reverting unauthorized changes.
How do you identify unauthorized changes in your network? How do you hunt through the tons of logs and data, and revert them?