Microsoft Intune service must automatically disable accounts after a 35-day period of account inactivity
DISA.V-267309MediumEntra IDIdentity GovernancePreview 3.0Runs with -IncludePreview
Part of DISA · Entra ID · Identity Governance · All checks
Invoke-Maester -TestId DISA.V-267309 -IncludePreviewOverview
Section titled “Overview”No enabled user account has gone 35 days or more without signing in. (DISA Microsoft Intune MDM Service Desktop STIG, V-267309, CAT II).
Intune administrators and users sign in with Microsoft Entra ID, so DISA’s Intune rule for inactive accounts is checked in Entra ID. A dormant account’s stolen password is unlikely to be noticed.
The Entra ID STIG has the same rule and audit script, so this test runs DISA.V-270204 with 35 days.
Remediation action
Section titled “Remediation action”- In the Microsoft Entra admin center, go to ID Governance > Access reviews and create a recurring review of inactive users with Days inactive set to 35.
- Let the review disable accounts that nobody vouches for, or run a scheduled automation that disables the accounts this test lists.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | DISA.V-267309 |
| Severity | Medium |
| Suite | DISA |
| Product | Entra ID |
| Feature | Identity Governance |
| Area | Identity lifecycle and hygiene |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267309 |
| Supports controls | disa-stig-intune-desktop:V-267309, nist-800-53-r5:AC-2(3) |
| PowerShell test | Test-MtDisaIntuneDesktopInactiveAccount |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |
Source
Section titled “Source”- Test:
tests/disa/Test.DISA.V-267309.ps1 - Documentation:
tests/disa/Test.DISA.V-267309.md