# Microsoft Intune service must automatically disable accounts after a 35-day period of account inactivity

No enabled user account has gone 35 days or more without signing in. (DISA Microsoft Intune MDM Service Desktop STIG, V-267309, CAT II).

Source: https://maester.dev/docs/tests/DISA.V-267309

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Entra ID · Identity Governance · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-267309 -IncludePreview
```

## Overview

No enabled user account has gone 35 days or more without signing in. (DISA Microsoft Intune MDM Service Desktop STIG, V-267309, CAT II).

Intune administrators and users sign in with Microsoft Entra ID, so DISA's Intune rule for inactive accounts is checked in Entra ID. A dormant account's stolen password is unlikely to be noticed.

The Entra ID STIG has the same rule and audit script, so this test runs [DISA.V-270204](https://maester.dev/docs/tests/DISA.V-270204) with 35 days.

#### Remediation action

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **ID Governance** > **[Access reviews](https://entra.microsoft.com/#view/Microsoft_AAD_ERM/DashboardBlade/~/Controls/fromNav/Identity)** and create a recurring review of inactive users with **Days inactive** set to **35**.
2. Let the review disable accounts that nobody vouches for, or run a scheduled automation that disables the accounts this test lists.

#### Related links

* [DISA Microsoft Intune MDM Service Desktop STIG: V-267309](https://cyber.trackr.live/stig/Intune_Service_Desktop/1/1/V-267309)
* [How to manage inactive user accounts](https://learn.microsoft.com/entra/identity/monitoring-health/howto-manage-inactive-user-accounts)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-267309 |
| Severity | Medium |
| Suite | DISA |
| Product | Entra ID |
| Feature | Identity Governance |
| Area | Identity lifecycle and hygiene |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267309 |
| Supports controls | disa-stig-intune-desktop:V-267309, nist-800-53-r5:AC-2(3) |
| PowerShell test | [Test-MtDisaIntuneDesktopInactiveAccount](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267309.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-267309.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267309.ps1)
- Documentation: [`tests/disa/Test.DISA.V-267309.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267309.md)