Centrally, by deactivating their device subscription in the portal. You do not need the hardware back for the access to stop working.