GOV-01: Review Stale User Accounts

GOV-01 is a security control that unused accounts are common attacker footholds. former employees, contractors, or forgotten accounts can be compromised without detection. regular review ensures only active users retain access. It requires that user accounts inactive for 90+ days are identified and reviewed and stale accounts are either disabled, deleted, or documented as exceptions, sign-in activity is reviewed at least quarterly.

Unused accounts are common attacker footholds. Former employees, contractors, or forgotten accounts can be compromised without detection. Regular review ensures only active users retain access.

GOV-01 requires manual implementation. Manual review required at Level 1; auto-disable available at Level 2

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

GOV-01 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.