A variety of methods exist to block access to a user’s Office 365 (Azure AD) account from a complete block to a conditional access policy. In this article, we examine the various methods and debate the worth of each approach. Conditional access policies are the cleanest and most effective long-term solution, but you need Azure AD premium licenses. If you don’t have those licenses, maybe one of the other approaches will work for you.
Organizations often disable Azure AD accounts when users leave or for other reasons. What you might not know is that Teams then removes the account from membership of individual teams. A background process looks for disabled users and removes these accounts from team memberships. That doesn’t sound too bad, but what’s horrible is when you unblock an account. Teams takes a long time (at least 24 hours) to restore standard teams, it might not ever restore membership of org-wide teams, and private channel membership is removed too. It’s not a good situation.