Please look in the policy this user would receive to make sure that the "exit PGP services" option is not set to be hidden. To find this in the SEMS 3.3.1 server, navigate to Consumers > Consumer Policy> [policy name] > General. Near the botton there is an option to "Hide the option to disable PGP Services".