Settings -> Users Disable/Enable is a full, immediate stop -- no matter how they sign in (Windows, Azure AD, or app account), and it cuts off an already-logged-in session right away. Nothing is deleted; disabling is fully reversible. Even a Fleet Admin account is blocked if disabled.

See account-lifecycle.md for the full technical story.