If enrollments are created/updated by regular, automatic SIS imports, then there is no way for an admin to effectively remove an enrollment from a Canvas course, or in other words, to block a user's access to a Canvas course. If the enrollment is deleted or deactivated, it will be reinstated, with an Active status upon the next SIS import. UI changes to enrollment status are not sticky. There have been sensitive situations at my institution that required users (including students and instructors) to have their access to a Canvas course blocked, that I do not want to go into detail about. But possible worst-case scenarios could include situations involving harassment, stalking, etc where it would be of immediate importance to remove one or more users from possible contact with others. There is the option to suspend a Canvas account. That may not be appropriate for every situation though - many situations may involve only a single course. I will also note that there are other Idea conversations open about the "suspend account" feature - for example, other course members can still see that a suspended user appears in their course. So it is not a solution to this problem.
The easiest solution would be making a UI change to the status of an enrollment a sticky change. But any way to temporarily block a user's access to a course would be acceptable.
