Not sure how I feel about this one. It's not that uncommon to have people around here asking why is a user still able to access resources after an account is disabled. MS needs to either update the way tokens are invalidated or raise more awarness on how to properly disable an account.
