How do you find and manage inactive user accounts in Microsoft Entra ID?

What “inactive” should mean in Microsoft Entra ID

Inactive accounts are not just users who have not signed in recently. In practice, they are identities with no recent legitimate activity and no clear business need to remain enabled. That includes former employees, stale contractor accounts, dormant privileged users, and accounts that may still hold group, app, or role access even when the person behind them is no longer active.

The useful test is whether the account still has a purpose. A low sign-in count alone is not enough to delete it automatically, because some accounts are intentionally dormant between projects or used only for exceptions. The better approach is to pair inactivity with ownership, role criticality, and access history before deciding whether the account should stay, be disabled, or be removed.

How to identify stale accounts without breaking legitimate access

Start by defining the inactivity threshold that matches your environment, then look at sign-in history, last interactive use, and the account’s current entitlements. In microsoft entra id, that means checking whether the user still belongs to groups, has app assignments, or holds directory roles that would make the account risky even if it has not been used recently.

A good workflow is to separate discovery from action. First, build the candidate list, then validate each account against an owner or manager, an employment or contractor record, and any exception reason. This reduces the chance of disabling a shared or break-glass account that is dormant by design, while still surfacing accounts that were simply forgotten.

• Use inactivity as a screening signal, not a deletion rule.
• Confirm whether the account still has downstream access before you touch it.
• Prioritise privileged users, service-linked accounts, and external collaborators first.

For broader lifecycle cleanup, the Joiner-Mover-Leaver (JML) Guide is the right reference point because stale access is usually a lifecycle failure, not just a directory hygiene issue.

How to manage inactive accounts safely once you find them

Disable before you delete when the business context is unclear. That preserves the ability to investigate whether the account was abandoned, misclassified, or still needed for an app, integration, or delegated workflow. If the account is confirmed unnecessary, remove it and revoke related access so the directory state and the actual access state do not drift apart.

Access reviews matter because inactivity and entitlement risk are related but not identical. An account can be inactive and still dangerous if it remains in privileged groups, owns OAuth-consented apps, or can reach sensitive data through inherited permissions. When you remove or disable the account, also review whether group memberships, app role assignments, and admin roles should be revoked separately rather than assumed to disappear with the user object.

The Privileged Identity Management (PIM) Guide helps where stale accounts intersect with elevated roles, because the real hazard is often not the mailbox or profile, but dormant privileged eligibility or active assignment.

Risk and Threat Considerations

Inactive accounts become a control gap when they are left enabled, overprivileged, or unowned. Attackers favor dormant identities because they often escape daily scrutiny, yet still preserve a path into email, apps, admin portals, or legacy integrations. The longer an account remains unused, the easier it is for stale permissions, forgotten secrets, or delayed offboarding to turn it into a hidden foothold.

Failure mechanism: Inactivity is treated as harmless while the account retains group membership, app access, or directory roles, so an abandoned identity remains available for misuse or takeover.

Impact: An attacker or ex-employee can reuse the account path for unauthorized access, privilege abuse, or persistence, and the cleanup effort becomes harder because the true blast radius includes every assignment tied to that identity.

Practitioner Guidance

What to verify: Before disabling anything, verify the account’s owner, last business purpose, and whether it still authenticates to any app or automation path. If there is no clear owner, treat the account as higher risk until proven otherwise.

Decision rule: If an inactive account still has privileged access, disable it first and investigate later. If it is a low-risk account with a clear owner and a valid exception, place it on a review cycle instead of forcing immediate removal.

Practitioner takeaway: Inactivity management is really access governance, so the goal is not just to find dormant users, but to make sure dormant identities cannot retain active authority.

Related resources from NHI Mgmt Group

• How do you manage and evaluate application consent requests in Microsoft Entra ID?
• How do you restrict user consent to applications in Microsoft Entra ID?
• How do you restrict default user permissions in Microsoft Entra ID?
• How do you find and clean up stale devices in Microsoft Entra ID?