In some situations, you may see the same person represented more than once in Vanta. This article explains why it happens, when it's expected, and how to resolve it when it isn't.
Why this can happen
Multiple representations of the same person can occur for the following reasons:
Multiple tenures: The person left and re-joined the company, or switched from a contractor role to a full-time employee role.
Multiple IDP accounts: An admin provisioned new IDP accounts for the same person during their employment. Prior IDP accounts were deleted or suspended.
A mix of manually-created and IDP-created people: Vanta or an admin may create multiple representations depending on when and how accounts were provisioned.
Changed personal information: If a person's email address or other identifying information changed, Vanta may track this as a separate person.
When multiple representations are acceptable
Having multiple representations for the same person is expected and appropriate when they track separate periods of employment. Each representation will have its own onboarding and offboarding history.
Note: Vanta ensures there can only be one active representation for a person associated with a given email address at a time.
Examples of intentional separate profiles:
A person who left and was later rehired
A person who transitioned from contractor to employee
In these cases, separate profiles are maintained intentionally for accurate audit tracking and should not be merged.
How to resolve multiple representations
If multiple representations exist for the same person and the same period of employment, use one of the following approaches:
Option 1: Mark the duplicate as out of scope
If a duplicate was created by mistake (for example, an extra IDP account), you may be able to mark it as out of scope from the Integrations page. This removes it from active compliance tracking without deleting any history.
Option 2: Resolve an IDP email deactivation/reactivation issue
Vanta may fail to correctly reload a person from your IDP if they were previously marked out of scope and then re-enabled. Here is an example of how this can happen:
Your IDP is connected, pulling in all users and creating people in Vanta.
An IDP user is marked out of scope, causing their Vanta record to become inactive.
A new person is manually created in Vanta using the same email address.
The IDP user is marked back in scope. Vanta fails to resurface the original record and may show an error on the related test:
To resolve this: The manually created person will need to be deleted by Vanta Support - customers cannot delete manually added users themselves. Contact [email protected] to request the deletion. Once removed, the IDP-powered record will resurface the next time Vanta refreshes data from your IDP.
Option 3: Request a merge from Vanta Support
If the above options don’t apply or don’t resolve the issue, Vanta Support may be able to merge the duplicate records for you.
To submit a merge request, contact [email protected] and provide:
Both email addresses associated with the duplicate records (specify which should be kept as the primary)
Confirmation that both records represent the same person and the same period of employment (not separate tenures)
What happens during a merge:
All tasks, access assignments, and compliance history are transferred to the primary profile.
The secondary profile is removed: if it is an IDP-connected account, it is scoped out and removed from the People page; if it is a manually created account, it is deleted.
Important: Merging profiles across separate employment tenures (such as rehires or contractor-to-employee transitions) is not best practice, as separate profiles are intentional and important for audit tracking. However, in cases where a new IDP profile cannot be created, Vanta Support may be able to assist with a merge. Before requesting this, confirm with your auditor that they are comfortable with the employment tenures and compliance history being combined into a single profile.