How to identify inactive users in Microsoft Entra ID

Inactive users linger in an organization due to improper deprovisioning of former employees and service accounts. Leaving these accounts unchecked leads to waste of licenses and security risks. These accounts could give attackers access to numerous sensitive groups that the users are a part of.

Microsoft Entra ID (formerly Azure AD) doesn't offer a direct way to obtain a list of inactive users. However, using the Access Review feature, reviewers can identify accounts that haven't been active for a set number of days.

M365 Manager Plus, the holistic M365 administration and security solution, generates a report that displays the list of inactive users. The table below compares how you can identify inactive users using Microsoft Entra ID and M365 Manager Plus.

What to do after you identify inactive users?

After identifying inactive users, you can block or disable them to prevent any security risks. Microsoft Entra ID lets you disable users by changing their account status.

To do this, navigate to Users > All users and click the user that you'd like to disable. Under My Feed, click Edit in the Account status section. Uncheck the Account enabled box and click Save. You'll have to repeat this process for each inactive account.

On the contrary, M365 Manager Plus enables you to automate the entire process of finding inactive users and blocking them in bulk, helping you save time and repetitive effort. Follow the steps below to automate the process of blocking inactive users in M365 Manager Plus.

1. Navigate to Automation > Create New Automation.
2. Select Block Users as the task.
3. Select Inactive Users as the report from which the objects will be imported.
4. Select the frequency at which the automation must be run.
5. Click Save.

Limitations of using Microsoft Entra ID to identify and disable inactive users

• The user requires the Identity Governance Administrator role to perform this operation.
• Getting a list of inactive users using Access Reviews is a roundabout approach that takes a long time.
• Each inactive user must be disabled individually.

Benefits of using M365 Manager Plus to identify and disable inactive users

• Simplified delegation: Empower non-admin users (technicians) to manage inactive users and more without elevating their Microsoft 365 privileges.
• Straightforward reports: Gain a thorough understanding of your environment in Microsoft Entra ID, Exchange Online, SharePoint Online, OneDrive for Business, and other Microsoft 365 services from a single console.
• Bulk operations: Block or unblock multiple inactive users in bulk and eliminate repetitive actions.
• Script-free experience: Manage users, groups, mailboxes, sites, and contacts effortlessly without PowerShell scripting.
• Granular insights: Keep tabs on even the most granular user activities in your Microsoft 365 environment.
• Ensure peak performance: Monitor the health and performance of Microsoft 365 features and endpoints around the clock.