Hi ​@DuquesneUniv, 

Welcome to Box Community, and we’re glad to answer your questions regarding the departed user’s permissions. 

1. If a user leaves and still has mobile devices logged in, will they be able to delete files/folders?

• Not after you take action. If you set their account to Inactive or delete the account, they cannot log in and cannot delete content. Admins can also remotely log the user out or un‑pin devices to immediately cut device access. However, whether content can be permanently deleted may be constrained by retention/governance settings — those policies can prevent deletion until the retention period ends.

2. How long does it take for their permissions to totally go away and mobile devices to be disabled after their email has been disabled?

• Permissions and ability to log in are revoked immediately when you change the user’s Status to Inactive or delete the user and/or when you un‑pin devices / remote log out: the restriction is effective immediately and active sessions will be terminated on next activity. 
• Caveat: some backend operations (content transfer, ownership changes, or disposition actions for large volumes) can take time to finish — often hours and in some high-volume or special cases up to ~72 hours for deletion/disposition to complete. If you delete a user and transfer a lot of content, expect the transfer to be chunked and to take time to fully appear in the recipient’s account. 

Hope it helps!