How to Find and Remove Dormant User Accounts in Microsoft 365
A business that has not systematically offboarded departing staff typically has 10 to 25 per cent more active Microsoft 365 accounts than it should. For a 50-person business, that is five to twelve accounts belonging to former employees, lapsed contractors, and concluded projects - each one a live authentication pathway that has no legitimate reason to exist. Finding them takes minutes. Removing them safely takes an hour or two. Leaving them is a risk that compounds with every departure that is not processed properly.
Why dormant accounts are a security risk
A dormant account that still exists in Entra ID and has an active Microsoft 365 licence retains all the access permissions it was granted when the person was active. It can be used to authenticate to Microsoft 365. It can access email, SharePoint, Teams, and any other service the original user had access to.
Former employees are a particular risk. An account that is not disabled after a departure can be accessed using the former employee's known credentials - credentials that, unlike a randomly generated service account password, may be in use across multiple platforms. If the person has left on poor terms, or if their credentials have been phished by an attacker who targets former employee accounts, the access remains live until someone explicitly removes it.
Dormant accounts also accumulate over time. A business that has operated for five years and has not systematically offboarded departing staff may have dozens of former employee accounts still active in their tenant.
How to find dormant accounts
Reports and tools to use
- Microsoft Entra ID sign-in logs: in the Entra ID portal (entra.microsoft.com), go to Users → Sign-in logs. Filter by date - accounts with no sign-in in the last 30 or 90 days are candidates for review. Export to CSV for analysis.
- Microsoft 365 admin centre - Inactive users report: the admin centre provides a report of users who have not signed in within a specified period. Go to Reports → Usage → and look for the Inactive users view.
- Microsoft Entra ID - Last sign-in date column: in the Users list in Entra ID, add the 'Last sign-in' column to see when each user last authenticated. Sort by this column to surface the oldest sign-ins.
- Microsoft 365 admin centre - Users list: filter by licence assignment and check the last activity date. Users with licences assigned but no recent activity are worth investigating.
- Comparison against HR system: the most reliable method is comparing your active Microsoft 365 user list against your current HR employee list. Any account in Microsoft 365 that does not correspond to a current employee or active contractor is a candidate for removal.
Categories of dormant accounts
Not all dormant accounts carry the same risk. Categorising them helps prioritise remediation.
Dormant account types and recommended action
| Account type | Risk level | Recommended action |
|---|---|---|
| Former employee - account enabled, licence active | High | Disable immediately, remove licence, export mailbox |
| Former employee - account disabled but not deleted | Medium | Verify mailbox preservation, then delete if retention period passed |
| External contractor - guest account, active | Medium–High | Confirm if still needed, remove if engagement concluded |
| Service account - application integration, unused | Medium | Identify owning application, disable if application decommissioned |
| Shared mailbox - no recent activity | Low | Review if still needed, archive or delete if not |
| Test account - created for a project | Medium | Remove unless still actively used for testing |
How to safely remove dormant accounts
Do not delete accounts without a preservation check. Deleting a Microsoft 365 account immediately starts a 30-day soft-delete window, after which the mailbox and all associated data are permanently deleted. Before deletion, confirm that any data worth retaining has been exported or transferred.
Steps before deleting a dormant account
- 1
Confirm the account is genuinely dormant
A last sign-in date of 90 days ago does not necessarily mean the person has left - they may be on extended leave. Verify against HR records before proceeding.
- 2
Check for mailbox data worth retaining
Review the mailbox for important business correspondence before deletion. Export to PST if required. Place on litigation hold if there are any pending legal matters involving the person.
- 3
Check OneDrive for files
OneDrive data is deleted 30 days after account deletion by default. Assign a secondary OneDrive admin before deletion and transfer any important files to SharePoint or another user.
- 4
Remove from distribution lists and shared mailboxes
Removing a user from groups does not happen automatically on account deletion in all configurations. Explicitly remove the account from distribution lists, security groups, and shared mailbox access.
- 5
Revoke active sessions before disabling
In Entra ID, select the user and choose Revoke sessions before or at the time of disabling the account. This invalidates any active authentication tokens.
- 6
Reclaim the licence
Unassign the Microsoft 365 licence before or at the time of account deletion. A dormant account that is disabled but still has a licence assigned continues to incur cost.
Building an ongoing process
A one-time dormant account cleanup is valuable, but the accounts will accumulate again without a process to prevent it. The minimum process is a formal offboarding checklist that includes account disabling as a same-day action on the final day of employment, and a quarterly review of accounts with no recent sign-in.
A more robust approach automates the offboarding trigger: a Power Automate workflow connected to your HR system that initiates the offboarding sequence - account disabling, session revocation, manager notification, and licence reclamation - when a departure is recorded in HR. This eliminates the gap between a person's last day and IT being notified.
A dormant account audit in a business that has not systematically managed offboarding typically reveals 10 to 25 per cent more accounts than expected. For a 50-person business, that may mean five to twelve accounts that should not exist. Each one is a live authentication pathway into your environment.
Sources & accuracy
Last reviewed: 5 October 2026 · Microsoft product capabilities, licensing and configuration options change regularly. Verify current details at learn.microsoft.com.
Next step
Microsoft 365 Security & Governance Baseline
The Microsoft 365 Health Check includes a dormant account review, licence audit, and admin role assessment - giving you a clear picture of who has access to your environment and what should be cleaned up.
Learn more