We need to be able to disable external users i.e. users who are part of SSO or LDAP directory but should not have access to Alfresco.
We cannot entirely disable the users as they need access to other applications that are part of the SSO infrastructure i.e. do not modify external account details but keep disabled status with other Alfresco specific fields in the profile. (as an aside it would be quite nice to have the option to sync more fields)
The UI does not allow us to disable the users but it can be done programmatically although the disabled user can still log in so has no impact(hence a bug).
Ideally there would be customizable page to show for authenticated but disabled users.