Option 1: I would consider LCS attribute to change it to different lifecycle value after 30 days of termination date. For example, change from inactive to “inactiveDisableAccess” and use the cloudLifecycleState configuration in Identity Profile to disable the required accounts and remove the access by using Remove All Access or use Workflow by using the Identity Attributes Changed trigger to trigger the Workflow, but it is based on other aspects like what else you need to do apart from removing access and disabling accounts.
Option 2: Other option is to create new identity attribute (accessRemoveFlag) where you can use Transform to assign a value like “InactiveRemoveAccess“ by calculating 30 days after the end date. Use something similar to Date Math 30 days out
In Workflow, use Identity Attributes Changed trigger to trigger the workflow when the attribute accessRemoveFlag value changed to InactiveRemoveAccess and perform the access removal and account disable operations.
Hope this helps you.