Disable accounts with no successful sign-in for {{ inactive_days }} days

Description

Member and guest user accounts whose last successful sign-in is older than {{ inactive_days }} days, or that never signed in more than {{ inactive_days }} days after creation, are disabled (Account enabled = No), then deleted after a retention period defined by the organization. The check runs at least monthly.

Documented exceptions are kept in a list: emergency access accounts (monitored separately), accounts of staff on long leave flagged by HR, and resource or shared mailbox accounts that are already blocked for sign-in.

lastSuccessfulSignInDateTime needs Microsoft Entra ID P1 to be read and can lag up to a day. Microsoft Entra ID Governance can automate the process with access reviews of inactive users or a lifecycle workflow. Synchronized accounts must be disabled in Active Directory, or the next sync re-enables them.

Rationale

An inactive account keeps its group memberships, licenses and sometimes roles, but nobody watches its sign-ins or MFA prompts. Departed staff, former contractors and forgotten test accounts are a classic entry point for password spray. Disabling them removes the target without losing data.

Impact

Users back from leave longer than {{ inactive_days }} days must ask the help desk to re-enable their account. Accounts used only by services or non-interactive sign-ins appear inactive: review them before disabling, and replace them with workload identities where possible.

Applies when

Requires: Microsoft Entra ID P1

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Reports Reader (Global Reader also works).
2. Browse to Entra ID > Users, select Manage view > Edit columns and add Last successful sign-in (or Last interactive sign-in time).
3. Filter on Account enabled = Yes and the last sign-in date older than {{ inactive_days }} days.
4. Alternative in PowerShell (Microsoft Graph, scopes User.Read.All and AuditLog.Read.All): $limit = (Get-Date).AddDays(-{{ inactive_days }}); Get-MgUser -All -Filter "accountEnabled eq true" -Property displayName,userPrincipalName,createdDateTime,signInActivity | Where-Object { ($_.SignInActivity.LastSuccessfulSignInDateTime -lt $limit) -and ($_.CreatedDateTime -lt $limit) }
5. Fail if enabled accounts older than {{ inactive_days }} days have no successful sign-in in that period and are not on the exception list.

Remediation

1. Export the list from the audit and send it to managers or HR for confirmation.
2. Disable confirmed accounts: in Entra ID > Users, open the user, Edit properties > Settings > clear Account enabled; or in PowerShell (scope User.ReadWrite.All, User Administrator) Update-MgUser -UserId <id> -AccountEnabled:$false. Disable synchronized accounts in Active Directory.
3. Revoke their sessions (Revoke-MgUserSignInSession -UserId <id>).
4. Delete them after the retention period, keeping the mailbox and files as required.
5. Automate with an access review of inactive users or a lifecycle workflow if Microsoft Entra ID Governance is available.

Rollback

Re-enable the account (Account enabled = Yes) after checking the request with the manager.

References

• How to manage inactive user accounts Microsoft, vendor-doc, accessed 2026-10-24
• Manage users with inactivity using lifecycle workflows Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-011 Remove unused and orphaned privileged role assignments

People and lifecycle