GOV-01: Review Stale User Accounts

GOV-01 is a security control that unused accounts are common attacker footholds. former employees, contractors, or forgotten accounts can be compromised without detection. regular review ensures only active users retain access. It requires that user accounts inactive for 90+ days are identified and reviewed and stale accounts are either disabled, deleted, or documented as exceptions, sign-in activity is reviewed at least quarterly.

Unused accounts are common attacker footholds. Former employees, contractors, or forgotten accounts can be compromised without detection. Regular review ensures only active users retain access.

TrueConfig provides one-click remediation for GOV-01. TrueConfig can disable a specific stale account in one click (disable_stale_account). The manual alternative is reviewing and disabling inactive accounts in the Entra admin center.

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

GOV-01 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.