GOV-02: Automatically Disable Stale Accounts

GOV-02 is a security control that manual reviews miss accounts. automated disabling ensures that former employees, forgotten accounts, and inactive identities cannot be used by attackers. the 14-day warning prevents disruption for legitimate users. It requires that accounts inactive for 90+ days are automatically disabled and a warning notification is sent 14 days before disabling, emergency access accounts and service accounts are excluded.

Manual reviews miss accounts. Automated disabling ensures that former employees, forgotten accounts, and inactive identities cannot be used by attackers. The 14-day warning prevents disruption for legitimate users.

TrueConfig can automate stale account disabling with exclusion lists

This control requires Azure AD Premium P2 (included in Microsoft 365 E5) or standalone P2.

GOV-02 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.