I second what Rakesh is saying, but if you are unable to remove those duplicate accounts for some reason, then there may be another solution. What type of source is your authoritative source? Active Directory, Workday, … ? I ask because some connectors have the ability to filter the accounts that are aggregated through an option called filterString. If your source connector supports it, and there is an account attribute we can key off of that indicates if the account is enabled/disabled, then we could potentially filter out the disabled accounts.