Description:
This control ensures that inactive and disabled user accounts are prevented from accessing Microsoft 365 resources. Disabling unused accounts reduces the risk of unauthorized access through dormant credentials and helps maintain an accurate inventory of active users.
Rationale:
Inactive and disabled accounts present a security risk because they may retain access to organizational resources despite no longer being required. Disabling these accounts reduces the attack surface and supports effective identity and access management practices.
Impact:
Reduces the risk of unauthorized access through dormant accounts.
Improves user account lifecycle management.
Supports compliance requirements related to access control and user management.
Ensures only authorized and active users retain access to organizational resources.
May require periodic review of user account status.
Default Value:
Disabled by default. Administrators must manually block sign-in for inactive accounts and ensure disabled accounts remain inaccessible.
Remediation
Test Plan
Sign in to the Microsoft Entra admin center with administrative privileges.
Navigate to Identity → Users → All users.
Review the list of user accounts.
Identify inactive or disabled user accounts.
Verify that inactive accounts have Block sign-in enabled.
Select a disabled account and review its status.
Verify that the disabled account cannot sign in to Microsoft 365 services.
If inactive or disabled accounts remain active, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Microsoft Entra admin center with administrative privileges.
Navigate to Identity → Users → All users.
Review user account activity and identify inactive accounts according to organizational policy.
Select the inactive user account.
Under Properties, select Block sign-in.
Set Block sign-in to Yes.
Click Save to apply the configuration.
Repeat the process for all inactive accounts that no longer require access.
Review existing disabled accounts to ensure Block sign-in remains enabled.
Verify that disabled accounts cannot access Microsoft 365 services.
Document the account status according to organizational procedures.
Backout Plan:
Sign in to the Microsoft Entra admin center with administrative privileges.
Navigate to Identity → Users → All users.
Select the disabled user account.
Under Properties, locate Block sign-in.
Set Block sign-in to No.
Click Save.
Verify that the user can access Microsoft 365 services according to the assigned permissions.
References: