Disabling devices which have been lost or stolen

[AB21805]

Is it possible to lock or disable devices which are intune enrolled and windows 10? 

I know its possible to wipe but was wondering if its possible to lock? 

[#2]

You can disable the device from Azure Portal >> AAD >> Devices >> All devices >> select the device and tick Disable on top menu

[#3]

This still allows AAD user to log into the device