How to find inactive users in Microsoft 365

What this check looks at

Finds enabled member accounts with no interactive sign-in inside the dormancy window.

Microsoft 365 never disables an account because it is not being used. Leavers whose accounts were never processed, staff on long leave, project accounts, shared mailboxes whose user accounts were left able to sign in, and test accounts all stay enabled, keeping their passwords, group memberships, mailbox access and often their licences.

This check looks at enabled member accounts and takes the most recent of each one’s interactive and non-interactive sign-ins. Accounts with neither in the last 90 days, or none recorded, are dormant. The check fails when dormant accounts make up 5 per cent or more of enabled members, and warns when there are some but fewer than 5 per cent. The evidence says how many still hold licences. It reports that it could not check when sign-in activity is unavailable (it needs Entra ID P1 and AuditLog.Read.All).

Dormant accounts are what password spraying and credential stuffing look for: nobody watches their MFA prompts or sign-in alerts, the password is old and may be in a breach list, and if the account never registered MFA the attacker can register their own. Shared mailbox accounts that allow sign-in are a common case, because their password is set once and never changed.

Why it matters

A dormant enabled account is an unmonitored credential, usually still licensed and still a member of whatever it was before the person left. It is the account an attacker prefers, because nobody notices the sign-in.

At a 200-person college, the account of a member of staff who left 18 months earlier is still enabled and has no MFA registered. Password spraying finds it with a common password, the attacker registers their own authenticator app, and uses the trusted internal address to send phishing to students and staff. Cleaning up means a forensic review, notifications and weeks of disruption; disabling the account at the time would have taken a minute.

Disabling rather than deleting is reversible and keeps the mailbox and files, and the licences that are then reclaimed often pay for the work.

ISO 27001 A.5.18 (access rights), CIS Controls v8 safeguards 5.1 (account inventory) and 5.3 (disable dormant accounts after 45 days of inactivity), Cyber Essentials’ user access control requirement and the NCSC CAF identity and access management outcome all expect unused accounts to be found and disabled.

How to fix it

Where: Entra admin centre → Identity → Users → All users

Before you start

• Check the list with HR or the business owner: dormant can mean long leave, a shared account, or a leaver.
• Convert needed mailboxes to shared before removing licences.

Step by step

1. 1Export the dormant accounts. Use the list in the evidence, or run in Microsoft Graph PowerShell (Connect-MgGraph -Scopes User.Read.All,AuditLog.Read.All): Get-MgUser -All -Property userPrincipalName,accountEnabled,userType,assignedLicenses,signInActivity | Where-Object { $_.AccountEnabled -and $_.UserType -eq "Member" } | Select-Object UserPrincipalName, @{n="LastSignIn";e={$_.SignInActivity.LastSignInDateTime}}, @{n="LastNonInteractive";e={$_.SignInActivity.LastNonInteractiveSignInDateTime}}, @{n="Licences";e={$_.AssignedLicenses.Count}} | Export-Csv dormant.csv.
2. 2Block sign-in on shared and resource mailboxes. In the Exchange admin centre, Recipients > Mailboxes, note which accounts are shared, room or equipment mailboxes. Nobody should sign in to them directly: block sign-in on each (Microsoft 365 admin centre, Users > Active users > the account > Block sign-in), which also takes them out of this finding.
3. 3Confirm the rest with HR. Send the remaining accounts to HR or the client contact and ask, for each one: left, on long leave, shared or service account, or still needed. Long leave is the usual exception.
4. 4Disable leavers and unneeded accounts. Block sign-in for each confirmed account and revoke its sessions. In Microsoft Graph PowerShell: Update-MgUser -UserId <upn> -AccountEnabled:$false, then Revoke-MgUserSignInSession -UserId <upn>. Disable rather than delete, so data can be recovered.
5. 5Deal with mailboxes, licences and access. Convert mailboxes colleagues need to shared (Exchange admin centre, Recipients > Mailboxes > the mailbox > Convert to shared mailbox), move any OneDrive content the business needs, then remove the licences under Users > Active users > Licences and apps. Remove the accounts from groups and admin roles at the same time.
6. 6Delete after the agreed retention period. Agree a retention period with the client (for example 90 days after disabling) and delete the accounts after it. Deleted users can be restored for 30 days.
7. 7Automate the review where licensed. With Entra ID P2, create a recurring access review under ID Governance > Access reviews, using the option to review inactive users where it is available; with Microsoft Entra ID Governance, use lifecycle workflows for leavers. Without either, add a quarterly dormant-account export to the MSP’s routine.
8. 8Confirm no unexplained dormant accounts remain. Re-run the export: no enabled member account should be idle for more than 90 days without a recorded reason. The finding clears at the next assessment.

What users will notice

Disabled accounts cannot sign in. Nothing is deleted, so an account can be re-enabled.

How to confirm it worked

The dormant enabled accounts in the evidence fall at the next assessment.

Frameworks and controls

This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Lifecycle workflows (Microsoft Learn)

Related checks

• Microsoft 365 offboarding checklist for leavers
• Disabled and dormant accounts that still hold admin roles
• How to check directory synchronisation is still running
• How to find licences on dormant Microsoft 365 accounts

The full Microsoft 365 security checklist, worst first