You may have a look at the below demo presented during one of the develper days. It will help you achieve the use-case.
For cloudlifecycle state changes, i would not be too concerned about it this approach works on setting an identity attribute and then during identity refresh these case where account have not been disabled will be captured automatically and then can be disabled.
Please check and let me know if this helps