An app registration is disabled while device code or brokered sessions on managed endpoints still rehydrate delegated access from existing trust state during a staged decommission

New logins are blocked and managed-session reuse keeps access alive. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.