According to the SSO Role-Application Matrix, the VPN is denied to retirees and former employees but can be overridden if they have an affiliation that allows access. Here are the affiliations that are allowed VPN access: