Microsoft Entra ID must automatically disable accounts after a 35-day period of account inactivity
Part of DISA · Entra ID · Identity Governance · All checks
Invoke-Maester -TestId DISA.V-270204 -IncludePreviewOverview
Section titled “Overview”No enabled user account in Microsoft Entra ID has gone 35 days or more without signing in (DISA Microsoft Entra ID STIG, V-270204, CAT II).
Accounts that nobody uses are a gift to an attacker: a stolen or guessed password for a dormant account is unlikely to be noticed, because its owner never sees the sign-in prompts, alerts or mailbox changes. DISA asks that accounts are disabled after 35 days of inactivity.
The check reads every enabled user, members and guests, as the STIG’s audit procedure does, and lists those whose last interactive sign-in is older than 35 days (InactiveDays), or who never signed in and were created more than 35 days ago. Microsoft Entra ID does not disable inactive accounts by itself, so the fix is a recurring process. ASD.ISM-1648 checks the same for privileged users with a 45-day limit.
Accounts that must stay enabled without signing in, such as emergency access accounts, need the exception documented with your authorizing official; leave them enabled and expect them in this list.
Remediation action
Section titled “Remediation action”- In the Microsoft Entra admin center, go to ID Governance > Access reviews and create a review of inactive users (Inactive users (on tenant level) only, with Days inactive set to 35).
- Set the review to recur, and set If reviewers don’t respond to Remove access or use the auto-apply option so that accounts nobody vouches for are disabled.
- Alternatively, run a scheduled automation that disables the accounts this test lists.
Related links
Section titled “Related links”- DISA Microsoft Entra ID STIG: V-270204
- How to manage inactive user accounts
- Create an access review of groups and applications
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | DISA.V-270204 |
| Severity | Medium |
| Suite | DISA |
| Product | Entra ID |
| Feature | Identity Governance |
| Area | Identity lifecycle and hygiene |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270204 |
| Supports controls | disa-stig-entra-id:V-270204, nist-800-53-r5:AC-2(3) |
| PowerShell test | Test-MtDisaInactiveAccount |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |
Source
Section titled “Source”- Test:
tests/disa/Test.DISA.V-270204.ps1 - Documentation:
tests/disa/Test.DISA.V-270204.md