How to find and remove stale accounts every month

Most firms remove access when someone leaves, but offboarding rarely reaches guest accounts, service accounts and the applications outside single sign-on. The logins left behind are stale accounts, and they are exactly the gap auditors and examiners look for. This checklist shows how to find them every month and keep the record you will be asked for.

What are stale accounts, and why do they matter?

Stale accounts are logins that no longer have a current, authorized owner using them: a departed employee, a contractor whose project ended, a guest from a closed deal, or a service account nobody remembers creating. Each one is a working credential that no one is watching, which makes it an easy path in for an attacker and an easy finding for an auditor or examiner.

For a financial firm, the obligation is written down. The FTC Safeguards Rule, 16 CFR 314.4(c)(1) requires access controls that permit access only to authorized users and limit each user to the customer information needed for their duties, and requires that those controls be periodically reviewed. SEC-registered advisers and broker-dealers must maintain written safeguards policies under Regulation S-P, 17 CFR 248.30. Neither rule sets a review frequency. The CIS Controls do.

What do the CIS Controls require?

Two Safeguards in CIS Control 5 set the baseline, and both are in Implementation Group 1, the starting set for small firms. Safeguard 5.1 requires an inventory of all accounts, including user, administrator and service accounts, with each person's name, username, start and stop dates and department, and validation that all active accounts are authorized at least quarterly. Safeguard 5.3 requires deleting or disabling dormant accounts after 45 days of inactivity, where supported.

Safeguard 5.5, in Implementation Group 2, adds an inventory of service accounts with an owning department, review date and purpose, reviewed at least quarterly. Control 6 requires a documented process for revoking access, ideally automated, when someone leaves or changes roles.

For the full starting set, see CIS IG1 explained: the 56 safeguards a small firm starts with.

Why run the review every month?

A monthly review is the simplest way to meet the 45-day dormancy limit, because a quarterly review cannot. If accounts are only checked every 90 days, one that went quiet the day after a review can sit enabled for three months. A monthly cycle, with accounts flagged at 30 days of inactivity, means every account that will cross 45 days before the next run has already had a decision. The quarterly authorization check in Safeguard 5.1 then becomes a roll-up of three monthly reviews instead of a separate project.

Where do stale accounts hide?

Stale accounts hide in the places the offboarding checklist does not reach.

• Shared mailboxes with sign-in left on. Microsoft's guidance for shared mailboxes is to always block sign-in for the account and keep it blocked.
• Guest accounts from past clients, auditors and vendors.
• Service accounts for scanners, backups and integrations, often with no named owner.
• Accounts converted from a departed user to keep email, then forgotten.
• On-premises Active Directory accounts that never synced to the cloud.
• Applications outside single sign-on: custodian and CRM portals, tax and practice management software, and cloud file shares with their own logins.

How do you find inactive users in Microsoft 365?

Find inactive users in Microsoft 365 (Office 365) by filtering on the last successful sign-in date. Microsoft Graph's signInActivity resource exposes three timestamps. The last interactive and last non-interactive sign-in dates both include failed attempts, so an account under a password-spray attack can look active. The lastSuccessfulSignInDateTime property records only successful sign-ins, and Microsoft recommends it for tracking actual account access. It has been recorded since December 1, 2023 and is not backfilled.

Microsoft's inactive account guidance notes that reading this property through Graph requires a Microsoft Entra ID P1 or P2 license, which Microsoft 365 Business Premium includes. In the Entra admin center, an administrator with at least the Reports Reader role can add a last interactive sign-in column to the user list and filter for accounts with no sign-in since a chosen date.

How do you find stale accounts in Active Directory?

Use the lastLogonTimestamp attribute, which Microsoft designed for finding inactive user and computer accounts, and allow for its lag. Microsoft's directory services team explains that with default settings it runs 9 to 14 days behind the current date, so an account can look up to two weeks more idle than it is. Build that lag into the threshold before disabling anything.

What does the monthly checklist look like?

1. Export every account from Entra ID and Active Directory with last successful sign-in, account type, license and manager.
2. Pull the same list from each application outside single sign-on.
3. Compare against the HR roster and the contractor and guest list, so departures are caught even when an account is still in use.
4. Flag every account with no successful sign-in in 30 days, every account tied to someone no longer on the roster, and every service account without a named owner.
5. Send each flagged account to its owner or manager for a keep, disable or delete decision with a reason.
6. Disable accounts with no answer by day 45.
7. Record the export, the decisions, who approved them and the date.

Should you disable or delete?

Disable first, then delete on a schedule. Safeguard 5.3 allows either. Disabling stops sign-in immediately while preserving the mailbox and files for any litigation hold or record retention obligation, and it lets the firm reverse a mistake. Set a holding period, confirm retention requirements are met, then delete and remove licenses.

Automation reduces the manual load. Entra Lifecycle Workflows can disable a leaver's account on their leave date and remove it from groups and Teams, and access reviews can remove guests who no longer need access. Check licensing first: Lifecycle Workflows require Microsoft Entra ID Governance, the Entra Suite or Microsoft 365 E7. Access reviews require Entra ID Governance, with some capabilities available under Entra ID P2, and reviewing guests also uses guest billing on an Azure subscription. Business Premium includes none of these.

What evidence will hold up in an exam?

A dated record that shows the review happened and that decisions followed. Keep each month's export, the list of flagged accounts, the owner's decision and the date each account was disabled. Map the process to NIST CSF 2.0 category PR.AA, identity management and access control, if your program uses that framework. Twelve monthly records answer the question "how do you know only authorized users have access?" better than a policy statement.

What should a firm do this quarter?

• Confirm which Entra license you hold and whether you can read last successful sign-in.
• Run the first full export, including applications outside single sign-on.
• Block sign-in on every shared mailbox.
• Assign an owner to every service account and record its purpose.
• Put the monthly review on the calendar with a named reviewer and a backup.

How does s90 help?

Identity Posture is s90's monthly identity review. We pull sign-in data across Microsoft 365, Active Directory and connected applications, flag dormant, orphaned and ownerless accounts, route decisions to the right manager, and keep the dated record your examiner or auditor will ask for. If you want to see what a first pass turns up in your environment, we can start there.