Dormant Office 365 users: what IAM teams need to clean up now

TL;DR: Dormant Office 365 accounts remain common, with Varonis finding 34% of internal accounts inactive but still enabled and 88% of companies admitting they still have stale accounts in 2025, creating low-noise entry points for attackers, according to Unosecur. Periodic audits are no longer enough; continuous discovery and closed-loop remediation are now the practical baseline for identity governance.

NHIMG editorial — based on content published by Unosecur: Why dormant Office 365 users are an attacker’s dream, and how to clean them up

By the numbers:

• 34% of internal accounts were inactive but still enabled across more than 130 enterprises.
• 88% of companies admit they still have stale accounts in 2025.

Questions worth separating out

Q: How should security teams handle dormant Office 365 accounts safely?

A: Start by identifying inactivity with sign-in and token telemetry, then validate business exceptions with HR or managers.

Q: Why do stale Office 365 users increase lateral movement risk?

A: Because they often retain valid access, inherited permissions, and mailbox or file sharing paths that were never re-evaluated.

Q: What do IAM teams get wrong about dormant user cleanup?

A: They focus on inactivity instead of access residue.

Practitioner guidance

• Build continuous dormant-account discovery Track interactive sign-in activity, token activity, and directory state together so inactive identities surface before attackers use them.
• Remediate stale access as one workflow Disable the account, revoke refresh tokens, remove group memberships, strip licences, and write evidence to your audit trail in the same runbook.
• Review privilege residue before reactivation Validate whether a dormant account still carries nested admin rights, shared mailbox access, or delegated collaboration permissions.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• The exact cleanup workflow for dormant Office 365 identities, including disablement, token revocation, licence removal, and group membership stripping.
• The practical threshold logic for flagging inactivity, including how teams decide when 90 days is appropriate and when exceptions apply.
• The Office 365 Connector workflow mechanics that automate identity cleanup across tenant-scale directories.
• The article's own framing of how stale users contribute to ransomware exposure and insider threat risk.

👉 Read Unosecur's analysis of dormant Office 365 users and identity cleanup →

Dormant Office 365 users: what IAM teams need to clean up now?

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →