However when our on-prem Active Directory server syncs our userbase up to 365, this option is overridden and that user is allowed to sign-in again.
What attribute do I need to set in our on-prem Active Directory server on the user object to match the the "Block this user" option seen in Microsoft 365? I think when I find out this setting, then the value will sync up to 365 and be persisted there.
What I've tried:
- marking the on-prem AD user account as Disabled (doesn't have an effect in 365 after sync);
- Moving the user account to a special/custom "Disabled Users" folder in our AD folder but it causes 365 to instead move the user into the Deleted Users area of 365 instead of simply prohibiting that Active User from signing in.