Azure AD Password Protection is not designed to control sign-in after an account is disabled. The SC-300 materials and Microsoft documentation describe it as a password-hardening feature: "Azure AD Password Protection provides a global banned password list and the ability to add custom banned passwords... to prevent users from using weak or compromised passwords." This capability governs password choice and reset policies, not the real-time authentication state of a synced user account.
Your observed delay is explained by the Azure AD Connect sync scheduler. In the exam content covering synchronization, Microsoft states: "By default, the scheduler runs every 30 minutes. A delta synchronization runs to import, synchronize, and export changes." Because the disable operation occurs in on-premises Active Directory, Azure AD will not reflect that change until the next synchronization cycle completes. Thus, a recently disabled user may still authenticate for up to that interval.
Therefore, enabling Password Protection would not meet the goal of immediately preventing Azure AD authentication. To achieve immediate effect, SC-300 guidance points to actions such as initiating an on- demand delta sync, disabling the account directly in Azure AD, or revoking sign-in sessions/tokens via Entra ID, rather than configuring Password Protection.