Disable Microsoft Entra ID accounts that have been inactive for more than 60-days
Recommendation Impact Across KPIs
| KPI | Impact | Calculated? |
|---|---|---|
| Reliability: | No significant impact on system reliability | ❌ |
| Security Compliance: | PRIMARY REC - Directly improves security posture by reducing attack surface through elimination of dormant accounts | ✅ |
| Economic: | No direct economic impact calculated | ❌ |
| User Experience: | No significant impact on user experience | ❌ |
| Environment: | No environmental impact | ❌ |
Score Calculation
1. Data Ingestion
- Asset Type: User
- Current Account Status
- Last Sign-in Activity
- Account Age
2. Data Enrichment
- Mapping to Microsoft Entra ID user data
- Account activity status
- Sign-in history analysis
3. Health Score
- Calculate the Security Compliance score using: ( * ) * Multiplier for length of compliance
Example Graph
Pie chart showing the distribution between active and inactive accounts, providing a clear visual representation of the proportion of accounts that require attention versus those that are regularly accessed.
Business Opportunities
Product Sales Opportunity
As a provider this recommendation provides you an opportunity to sell identity management and security tools that can help maintain ongoing account security.
Professional Services Opportunity
The recommendation provides an opportunity to deliver professional services for identifying and disabling inactive accounts, implementing automated monitoring solutions, and establishing governance processes. The implementation involves strategic planning and careful execution to avoid business disruption.
Remediation Guidance
To resolve the recommendation the following steps are recommended:
- Develop an Inactive Account Management Plan
- Identify Inactive Accounts
- Assess Impact
- Allocate Resources
Establish Timeline
Communicate with Stakeholders
- Notify Account Owners
- Provide Instructions
Set Expectations
Execute Account Disablement
- Identify Inactive Accounts in Entra ID
- Disable Accounts
Ensure No Impact
Post-Disablement Monitoring
- Monitor Disabled Accounts
- Handle Reactivation Requests
Update Records
Ongoing Maintenance
- Review Regularly
- Automate Process
- Audit and Compliance
Supporting Information
Supported Data Sources
- Microsoft Graph Entra ID
Recommendation Categorisation
- Security
- Compliance
- Identity Management
Supported Instances
- Microsoft Entra ID
API Information
- Endpoint: GET https://graph.microsoft.com/v1.0/users
- Parameters: $select=displayName,userPrincipalName,id,signInActivity
- Filter: signInActivity/lastSignInDateTime le {today - 60 days}