Topic starter
24/06/2026 5:43 pm
TL;DR: Unosecur reports that dormant Office 365 users remain a hidden access path because inactive accounts often retain MFA gaps, legacy protocol access and privilege drift. Periodic clean-up assumes identities stay visible long enough to review, but stale accounts turn governance into after-the-fact archaeology.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Orphaned Office 365 Accounts: How to Detect & Clean Up”.
By the numbers:
- 34% of internal accounts inactive, but still enabled.
- 88% of companies admit they still have stale accounts in 2025.
Key questions
Q: What breaks when Office 365 dormant accounts are left in place?
A: Dormant accounts keep valid access paths alive even after ownership has been lost, which means a mailbox, guest identity, or service principal can still be abused later.
Q: Why do stale accounts increase breach impact in cloud collaboration environments?
A: They increase impact because the identity may still reach mail, files and chat while also carrying inherited permissions into connected systems.
Q: How should teams decide whether a dormant account can stay enabled?
A: Teams should decide by validating business need, legal hold status, contractor return plans and break-glass ownership before keeping anything active.
Practitioner guidance
- Implement continuous dormant-account discovery Track internal users with no interactive sign-in or token activity for your chosen threshold, then review them continuously instead of waiting for quarterly audits.
- Revoke access in one offboarding workflow When an account is confirmed stale, disable it, revoke refresh tokens, remove licences and strip group memberships in the same workflow so residual access does not linger.
- Validate dormant accounts before removal Cross-check stale identities against HR, managers, legal hold requirements and break-glass ownership before deprovisioning anything that might still be needed.
Bottom line: Dormant Office 365 accounts remain dangerous because inactivity does not automatically remove tokens, group memberships or legacy access paths.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- A practical cleanup workflow for dormant Office 365 users, including validation steps before disablement
- How to revoke refresh tokens, licences and group memberships without leaving residual access behind
- The connector workflow the vendor describes for automating account closure at tenant scale
- Examples of the audit evidence teams need when deprovisioning stale identities
👉 Read Unosecur's analysis of dormant Office 365 users and attacker access paths →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
25/06/2026 3:39 am
Dormant identities create lifecycle debt, not just directory clutter. The problem is not that the account exists, but that its permissions, tokens and memberships continue to act as though the user still has a business purpose. In IAM terms, the organisation has let identity state drift away from operational reality, and that is what attackers exploit.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What is the difference between periodic audits and continuous discovery for stale identities?
A: Periodic audits look for stale accounts at fixed intervals, which means the control is always behind the risk. Continuous discovery watches for inactivity and residual access as it emerges, so remediation can happen while the identity still matters. In practice, continuous discovery turns identity cleanup from a report into an operating process.
👉 Read our full editorial: Dormant Office 365 users create hidden access paths for attackers
This post was modified 4 days ago by NHI Mgmt Group