To remove the ability of a network object, such as a user account or a network-joined computer to access the resources that the server provides. Deactivating a network object does not delete the object from the active directory, nor does it delete any data that is associated with the object.
A process, when an assigned user who is already activated in a role, decides to withdraw from the role access rights, and return back to the normal state of no access rights of this role.