ArcGIS Enterprise Portal allows you to set showForgotUsername: false in the config.js and it also allows you to disable the ability for users to create built-in accounts via the portal organisation settings page. What is missing is the ability to disable the "forgot password" interface. Using this interface allows someone to confirm/deny the existence of accounts within the identity store even if that identity is within the built-in store or a 3rd party identity store (e.g. ldap).
