Why is it not possible to inactivate the only Domain Admin in a Vault?
Vault requires there to be at least 1 active Domain Admin with membership to the Vault even if there are other Active Domain Admins associated with other Vaults in the Domain. A new Domain Admin will need to be chosen before Vault will allow users to inactivate a user that is the last Active Domain Admin in a Vault.
Vault Help Documentation: Creating & Managing Users
Vault Help Documentation: How to Grant Domain Admin Access