When the administrator deletes or disables a DeviceID token using the Admin Console, email access from the device will not be blocked immediately as the Exchange server keeps a session for the device. There are 2 ways to block a device immediately as soon as its DeviceID token is deleted or disabled in the MFA server.