Privileged user accounts should not remain enabled when the linked primary account is disabled

Contributed by Thomas NaunheimAll contributors →

Part of Maester · Defender · Exposure Management · All checks

Run this check

Invoke-Maester -TestId MT.1112 -IncludePreview

Overview

Reviewing the enabled status of a privileged account when the linked user identity has been disabled is critical to prevent orphaned high‑risk access. If a normal work account is deactivated (for example, because the user left the organization) but the related privileged account remains enabled, an attacker or former employee could still use that privileged identity to access sensitive systems, change security settings, or exfiltrate data unnoticed. Regularly checking and aligning the status of privileged accounts with their primary identities helps enforce least privilege, reduces the attack surface, and ensures that privileges are revoked promptly when a user’s employment or role ends.

How to fix

Review the results from this check and verify whether it is legitimate for the privileged user account to remain enabled when the associated primary work account has been disabled.

Details

Every attribute of this check

Field	Value
Test ID	MT.1112
Severity	Medium
Suite	Maester
Product	Defender
Related products	Entra ID
Feature	Exposure Management
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports controls	nist-800-53-r5:AC-2
PowerShell test	Test-MtXspmEnabledPrivilegedUsersLinkedToDisabledIdentity
Services	Graph
Lifecycle	Preview
Long running	Yes

Source

• Test: tests/maester/xspm/Test.MT.1112.ps1
• Documentation: tests/maester/xspm/Test.MT.1112.md