What this check looks at
Finds privileged role assignments on accounts that are disabled or have not signed in recently.
Privileged role assignments in Microsoft Entra ID never expire on their own. When someone leaves or changes job, their account is usually disabled or simply stops being used, but nothing removes the admin roles it holds. The roles stay attached indefinitely, invisible in day-to-day work.
This check goes through every privileged role holder and flags accounts that are disabled, and accounts with no interactive sign-in for more than 90 days (the tenant’s dormancy threshold). Where Microsoft returns successful sign-ins, an account with no successful sign-in in that time is flagged too, so a stream of failed attempts, such as a password spray, does not make a dormant admin look active. The check fails when any privileged account is disabled or dormant, at high severity if any of them is disabled. It warns when nothing is flagged but some role holders have no recorded sign-in at all, and reports that it could not check when sign-in activity is unavailable (it needs Entra ID P1 and AuditLog.Read.All).
A dormant admin account is an ideal target: nobody is watching its MFA prompts or sign-in alerts, its password may be old and reused, and an attacker’s sign-in stands out to no one. A disabled account is safe only until someone re-enables it, for example to retrieve a leaver’s mail, at which point full admin rights return silently; a disabled synchronised account can also be re-enabled from on-premises Active Directory.
Why it matters
Role assignments that outlive their purpose are pure downside: nobody is watching them, and re-enabling a disabled account silently restores administrative power.
A common pattern: an IT contractor finished a project two years ago, their account was left enabled but unused, and it still holds Exchange Administrator. The password turns up in a breach list, an attacker signs in, and with Exchange Administrator sets up forwarding on the directors’ mailboxes and reads months of correspondence before an invoice fraud attempt gives them away.
Removing roles nobody uses has no business cost and removes the risk entirely. It is also the evidence an auditor looks for when testing leaver processing and periodic access reviews.
ISO 27001 A.5.18 (access rights) and A.8.2 (privileged access rights) require privileged access to be reviewed and removed when no longer needed. CIS Controls v8 safeguards 5.3 (disable dormant accounts) and 6.2 (access revoking process), the NCSC CAF privileged user management outcome and Cyber Essentials’ user access control requirement say the same.
How to fix it
Where: Entra admin centre → Identity → Roles and administrators
Before you start
- Check with the account owner or their manager that the access is no longer needed, particularly for dormant (not disabled) accounts.
Step by step
- Review the flagged accounts. Open the evidence: each account is listed with its roles and the reason (account disabled, the number of days since its last interactive or successful sign-in, or no successful sign-in on record). For dormant but enabled accounts, ask the owner or their manager whether the access is still needed; long leave is the usual exception.
- Check the sign-in history yourself. In the Microsoft Entra admin centre, Entra ID > Users, open each account and select Sign-in logs, looking at both interactive and non-interactive sign-ins. If a dormant account turns out to be used by a script, plan to move the script to an app registration rather than keeping a dormant admin account.
- Remove the role assignments in the portal. Open each account in Entra ID > Users > Assigned roles, tick every privileged role and choose Remove assignments. If PIM is in use, also check ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments for eligible assignments on the same account and remove them.
- Or remove them with PowerShell. In Microsoft Graph PowerShell run Connect-MgGraph -Scopes RoleManagement.ReadWrite.Directory, then Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '<object id>'" to list the account’s active assignments, and Remove-MgRoleManagementDirectoryRoleAssignment -UnifiedRoleAssignmentId <assignment id> for each one.
- Finish dealing with the account. For leavers, leave the account disabled, remove licences once the mailbox has been dealt with, and delete it when your retention period allows. For dormant accounts confirmed as unneeded, also block sign-in (Microsoft 365 admin centre > Users > Active users > the user > Block sign-in).
- Set up a recurring review of privileged roles. With Entra ID P2, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Access reviews > New, scope it to all privileged roles, repeat it quarterly with a named reviewer, and turn on auto apply with If reviewers don’t respond set to Remove access. Without P2, put a quarterly role review in the MSP’s calendar.
- Add role removal to the leaver checklist. Add “remove all directory roles and PIM eligibility” to the client’s leaver procedure, before the account is disabled, so the next leaver does not reappear in this finding.
- Confirm no flagged account holds a role. Open Entra ID > Roles & admins and check that none of the listed accounts appears as a member of any privileged role, active or eligible. The finding clears at the next assessment.
What users will notice
None for active staff. The listed accounts lose their admin roles.
How to confirm it worked
Roles and administrators: none of the listed accounts hold a privileged role.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | User access control |
| Cyber Essentials Plus | Account separation test: admin accounts used only for administrationUser access control |
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-4 Review and reconcile user access regularly |
| Zero Trust | Identities |
| SOC 2 | CC6.2 User registration, authorisation and removalCC6.3 Role-based access and least privilege |
| PCI DSS 4.0.1 | 8.2.6 Inactive user accounts are removed or disabled within 90 days7.2.4 User accounts and access privileges are reviewed every six months |
| NIST SP 800-171 | 3.5.6 Disable identifiers after a defined period of inactivity3.1.5 Employ the principle of least privilege |
| CMMC Level 2 | IA.L2-3.5.6 Identifier HandlingAC.L2-3.1.5 Least Privilege |
| ISO 27001:2022 | A.5.18 Access rightsA.8.2 Privileged access rights |
| CIS Controls v8.1 | 5.3 Disable dormant accounts (IG1)6.2 Establish an access revoking process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of dutiesPR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Access reviews (Microsoft Learn)