GOV-02MediumEnhanced Security

Automatically Disable Stale Accounts

Governance & Hygiene control for Microsoft 365 and Entra ID

Why This Control Matters

Manual reviews miss accounts. Automated disabling ensures that former employees, forgotten accounts, and inactive identities cannot be used by attackers. The 14-day warning prevents disruption for legitimate users.

Expected State

When this control is compliant, your tenant should meet these criteria:

  • 1Accounts inactive for 90+ days are automatically disabled
  • 2A warning notification is sent 14 days before disabling
  • 3Emergency access accounts and service accounts are excluded

Enforcement

Default Mode
Auto-Remediate

Automatically fixes deviations when safe to do so

Auto-Remediation
Available

TrueConfig can automate stale account disabling with exclusion lists

Ready to implement this control?

TrueConfig continuously monitors your Microsoft 365 tenant for compliance with this and 50+ other security controls.