You cannot remove the identities from the automated roles i.e roles with membership criteria. They will get revoked only based on criteria. So, you can add additional criteria in the automated role to define the identity status like LCS = active, this will revoke the role when identity moving to inactive.
For the non membership criteria roles or requestable role, you can use Certification campaign to revoke the access when they move to inactive. This is pretty much possible using Workflow Workflow to remove ALL leavers' standing access