Disabled user accounts
AI summary
Disabled user accounts pose security and compliance risks by retaining access to sensitive resources while creating administrative overhead. A Rencore Governance policy identifies these accounts in your Microsoft 365 tenant. Establish an offboarding process with data archiving, automated removal from groups, and scheduled deletion.
What it detects
Shows all disabled user accounts.
Why it matters
Disabled accounts that remain in your tenant indefinitely create security risks, compliance issues, and administrative overhead while potentially retaining access to sensitive resources. Establish a comprehensive offboarding process that includes data archiving requirements, automated removal of disabled users from all groups, and scheduled account deletion after an appropriate retention period to maintain a clean and secure environment.
The rule
Every User where Account enabled is false
In Rencore Governance
Details
| Applies to | User |
|---|---|
| Connector | Microsoft 365 |
| Severity | Medium |
| Category | User OffboardingLeaverA leaver is someone who has left your organization but whose account may still hold licenses, workspaces, ownership and OneDrive content.Read more |
| Recommended | Yes |
| Recommended automation | None |
| License type | Standard |
Related policies
Other policies that check User objects:
- Copilot adoption opportunity - E3/E5 users (Medium)
- Copilot license assigned to disabled account (High)
- Inactive Copilot users - 30 days (Medium)
- Excessive draft agent creation pattern (Medium)
- External users (Information)
- External users with pending acceptance (Low)
- Users with Power Platform Premium license (Information)
- Users with E3 license not using Outlook in last 12 month (Low)
- Users with passwords not changed in last 6 months (Medium)
- Admin accounts with an Office 365 E3 license assigned (Medium)
- Administrators without MFA (High)
- External users invited 3 month ago with pending acceptance (Low)
- Disabled user accounts with assigned licenses (High)
- Global administrators without MFA (High)
- Guest users with a Dynamics license assigned (Medium)
- Inactive external users (Medium)
- Inactive internal users (Medium)
- Over-licensed user accounts (High)
- Users who are creating Microsoft Loop Teams components (Medium)
Frequently asked questions
What does the disabled user accounts policy detect?
The Disabled user accounts policy shows all disabled user accounts.
Which objects does the disabled user accounts policy check?
The Disabled user accounts policy checks User objects from the Microsoft 365 inventory and reports each one that matches its rule as a violation.
How severe is a violation of the disabled user accounts policy?
Violations of the Disabled user accounts policy have Medium severity. The policy is in the User Offboarding category.
Which module includes the disabled user accounts policy?
The Disabled user accounts policy comes with the Microsoft 365 connector in the Digital Workplace module of Rencore Governance, which every Plan includes.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?