After disabling an account (is_account_disabled flag set to true in the database), the account was still able to log into the EMF using SSO.