Inactive external users

Last updated Oct 17, 2026 Policies Access & Sharing

AI summary

External users who have not signed in for more than six months likely no longer require access, yet retain potential entry points to your systems. Rencore Governance identifies these accounts so you can remove them and reduce your security and compliance risks.

Severity: Medium External Access Generally available

What it detects

Shows external users that have not signed in for more than 6 month.

Why it matters

External users who haven't accessed your environment in six months likely no longer require access, yet retain potential entry points to your systems and data. Remove inactive external users to reduce attack surface and compliance risks, implement automated monitoring through Rencore Governance to flag inactive accounts, and establish regular cleanup cycles to maintain a secure environment with only actively necessary external access.

The rule

Every User where Is External is true and Last Sign-In is more than 6 months ago and Last Sign-In is not default and External User State not like 'PendingAcceptance'

In Rencore Governance

Details

Applies to	User
Connector	Microsoft 365
Severity	Medium
Category	External Access
Recommended	No
Recommended automation	None
License type	Standard

Other policies that check User objects:

Copilot adoption opportunity - E3/E5 users (Medium)
Copilot license assigned to disabled account (High)
Inactive Copilot users - 30 days (Medium)
Excessive draft agent creation pattern (Medium)
External users (Information)
External users with pending acceptance (Low)
Users with Power Platform Premium license (Information)
Users with E3 license not using Outlook in last 12 month (Low)
Users with passwords not changed in last 6 months (Medium)
Disabled user accounts (Medium)
Admin accounts with an Office 365 E3 license assigned (Medium)
Administrators without MFA (High)
External users invited 3 month ago with pending acceptance (Low)
Disabled user accounts with assigned licenses (High)
Global administrators without MFA (High)
Guest users with a Dynamics license assigned (Medium)
Inactive internal users (Medium)
Over-licensed user accounts (High)
Users who are creating Microsoft Loop Teams components (Medium)

Frequently asked questions

What does the inactive external users policy detect?

The Inactive external users policy shows external users that have not signed in for more than 6 months.

Which objects does the inactive external users policy check?

The Inactive external users policy checks User objects from the Microsoft 365 inventory and reports each one that matches its rule as a violation.

How severe is a violation of the inactive external users policy?

Violations of the Inactive external users policy have Medium severity. The policy is in the External Access category.

Which module includes the inactive external users policy?

The Inactive external users policy comes with the Microsoft 365 connector in the Digital Workplace module of Rencore Governance, which every Plan includes.

Was this page helpful?