Report for active security profiles (not locked and active checked)

Summary:

Our auditors have requested a report of all users who can access the ERP system.

Content (please ensure you mask any confidential information):

This would be best achieved by building a report against the security console profiles being active or inactive, as we do not maintain terminations from our HCM system due to an issue with historical edits, but development has not allowed access to the tables behind the security console as far as I can tell. Is there a way to get a report of all active security profiles in security console? Or another flag to use?

Version (include the version you are using, if applicable):