If a user is given some roles, sso's and then has all their roles removed then they will be given the default role.