I went looking at the login audit trail and did a search - most likely offending role is administrator or full access (deprecated)