The identity was disabled. Its token still worked.

Disabling an account and removing its access are two different events. A controlled laboratory run made the gap visible: the identity provider accepted the disable operation, but the application still