Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is the only supported way to disable a user, but other hacks seem to be prevalent to support legacy apps or processes.
I ask because I believe this is the only secure way, but many guides and companies tend to follow an approach which changes the password for the user to something they don't know. I think other methods such as moving an account to an OU which cannot log in are even more flawed.
Historically this might have been a good practice when all applications where on-premises, but with cloud applications using many sync tools it seems like an AD account being disabled is the only safe indicator for upstream applications.
It seems like some applications like the latest versions of Outlook with O365 support invalidation of credentials with ADAL following a password reset, but I doubt this is universal.