diff --git a/Puppetfile b/Puppetfile
index 91b9b08..9b7e829 100644
--- a/Puppetfile
+++ b/Puppetfile
@@ -18,7 +18,7 @@ mod 'ncsa/profile_allow_ssh_from_bastion', tag: 'v0.2.0', git: 'https://github.c
 # mod 'ncsa/profile_firewall', tag: 'v1.0.1', git: 'https://github.com/ncsa/puppet-profile_firewall'
 mod 'ncsa/profile_pam_access', tag: 'v0.0.4', git: 'https://github.com/ncsa/puppet-profile_pam_access'
 # mod 'ncsa/profile_puppet_master', tag: 'v0.1.0', git: 'https://github.com/ncsa/puppet-profile_puppet_master'
-# mod 'ncsa/profile_sudo', tag: 'v0.1.0', git: 'https://github.com/ncsa/profile_sudo'
+mod 'ncsa/profile_sudo', tag: 'v0.1.1', git: 'https://github.com/ncsa/puppet-profile_sudo'
 # mod 'ncsa/profile_timezone', tag: 'v0.1.0', git: 'https://github.com/ncsa/puppet-profile_timezone'
 mod 'ncsa/sshd', tag: 'v0.3.0', git: 'https://github.com/ncsa/puppet-sshd'
 mod 'ncsa/sssd', tag: 'v3.0.0', git: 'https://github.com/ncsa/puppet-sssd'
@@ -37,7 +37,7 @@ mod 'puppetlabs/stdlib', '6.3.0'
 # mod 'puppetlabs/xinetd', '3.3.0'
 mod 'richardc-datacat', '0.6.2'
 # mod 'saz/limits', '3.0.4'
-# mod 'saz/sudo', '6.0.0'
+mod 'saz/sudo', '6.0.0'
 # mod 'saz/timezone', '6.0.0'
 # mod 'sharumpe-tcpwrappers', '1.0.4'
 #mod 'sharumpe-tcpwrappers', tag: '1.0.7', git: 'https://github.com/sharumpe/puppet-tcpwrappers.git'
diff --git a/data/common.yaml b/data/common.yaml
index 4c053c6..aa5e79c 100644
--- a/data/common.yaml
+++ b/data/common.yaml
@@ -12,6 +12,16 @@ profile_allow_ssh_from_bastion::groups:
   - org_asd
   - org_irst
 
+profile_sudo::configs:
+  common_disabled_users:
+    priority: 1
+    content:
+      - "#deny former NCSA users"
+      - "%all_disabled_usr ALL=(ALL) !ALL"
+profile_sudo::groups:
+  org_asd: "ALL=(ALL) NOPASSWD: ALL"
+  org_irst: "ALL=(ALL) NOPASSWD: ALL"
+
 sssd::debug_level: 0
 sssd::domains:
   ncsa.illinois.edu:
diff --git a/site-modules/profile/manifests/base.pp b/site-modules/profile/manifests/base.pp
index a965c41..c8b6d89 100644
--- a/site-modules/profile/manifests/base.pp
+++ b/site-modules/profile/manifests/base.pp
@@ -6,7 +6,7 @@ class profile::base {
   include ::profile_allow_ssh_from_bastion
 #  include ::profile_email
   include ::profile_pam_access
-#  include ::profile_sudo
+  include ::profile_sudo
 #  include ::profile_timezone
   include ::profile::sssd
   include ::sshd