Comment by confuseddeputy

I am pretty confident that the statement is false.

The `sub` claim value is equivalent to the user ID that's exposed in the Directory API, it's derived from the underlying user account's unique user ID, and it won't change unless the user account is recreated.