If a user is deactivated on Okta, can the user still sign-in to the application outside of Okta? If the application supports local accounts. For example in ServiceNow you can have SSO, local account, and AD access enabled, so if the local account and AD account were still active then they could still access the application.
Is the user disabled on the application? Is the user disabled on AD? If you have AD as your Master then when the user is deactivated in AD they are disabled in Okta. If you are using Okta as your Master then you would need to deactivate them in Okta.
What additional tasks need to be performed after we deactivate a user on Okta? If they have local accounts within the various aplications Okta manages then you would want to disable those local accounts.
Is removing a user on Okta has the same impact on the user app capabilities as deactivating? Yes if they don't exist in Okta they can't access apps housed in Okta.