Dormant Account Cleanup: Find and Disable Stale Logins (2026)

Most small businesses can tell you who works for them today. Far fewer can tell you how many logins exist. Over the years, accounts pile up: the intern from two summers ago, the contractor who finished a project, the test user someone created to try a new app.

Those forgotten accounts are called dormant or stale accounts, and attackers love them. Here is why they matter and how to clean them up without breaking anything.

1. Why dormant accounts are a real risk

An unused account still has a password, still receives email, and often still has access to files. The only thing missing is a person who would notice something wrong.

• Nobody sees the warning signs. A real employee notices an odd MFA prompt. An abandoned account just quietly accepts a password spray or credential stuffing attempt.
• Old accounts often have weak protection. They predate your MFA rollout or were exempted from it, and the password may have leaked in a breach years ago.
• Access keeps accumulating. A former employee's account may still reach shared drives, line-of-business apps, and customer data.
• You pay for them. Idle licenses cost money every month. Our SaaS subscription audit shows how much waste usually hides there.
• They complicate compliance. Cyber insurers, auditors, and frameworks such as HIPAA and CMMC expect you to remove access that is no longer needed.

2. How to find them

You do not need special software to start. Both major platforms report last sign-in dates.

• Microsoft 365. In the Entra admin center, open Users and review sign-in activity, or use the active users report in the Microsoft 365 admin center. Sort by last sign-in and look for anything older than 90 days.
• Google Workspace. In the Admin console, open Directory, then Users, and add the Last sign-in column. Sort oldest first.
• Everything else. Check your accounting software, CRM, password manager, VPN, remote access tools, and website admin. These rarely sync with your main directory, so they are where orphaned accounts hide.
• Compare against HR. Match the list to your current staff roster and your asset inventory. Any account without a clear owner is a question to answer.

Be careful with service accounts, shared mailboxes, and scanners. They may never sign in interactively but still do important work. Find out what depends on them before changing anything.

3. How to clean up safely, and keep it clean

The goal is to shrink your exposure without a surprise outage.

• Confirm with a manager. A quick message asking "does this person still need access?" prevents most mistakes. Leave a note in your records either way.
• Disable first. Block sign-in, revoke active sessions, reset the password, and remove licenses. Convert a departed employee's mailbox to a shared one if the team still needs the mail.
• Wait, then delete. Keep the data for 30 to 90 days. If nobody asks for it, delete according to your retention policy.
• Fix the cause. Most dormant accounts come from a missed step at exit. Use a written offboarding checklist, and treat shared logins with an owner and a purpose.
• Review quarterly. A recurring 30-minute check, plus a review after any layoff or vendor change, keeps the problem from returning.

The takeaway

You cannot protect an account you do not know exists. A quarterly review of inactive logins costs about half an hour and closes some of the quietest doors into your business. Find the idle accounts, confirm who owns them, disable first, delete later, and fix the offboarding gap that created them. Pair this with multi-factor authentication on every account that stays.

Frequently asked questions

What is a dormant account?

A dormant account is a user login that still works but has not been used for a long time, typically 60 to 90 days. It usually belongs to a former employee, a finished contractor, a test user, or a forgotten shared mailbox. Nobody is watching it, which makes it attractive to attackers.

How often should a small business review inactive accounts?

Quarterly is a good rhythm for most small businesses. Also run a review after any layoff, seasonal hiring wave, vendor change, or software migration, since those events create the most orphaned accounts.

Should I delete a dormant account or just disable it?

Disable first. Block sign-in, revoke sessions, remove licenses, and keep the data for 30 to 90 days in case someone needs it. Delete only after the retention period and after confirming no mail, files, or automations depend on it.

How do I find inactive users in Microsoft 365 and Google Workspace?

In Microsoft 365, use the Entra ID sign-in activity report or the Microsoft 365 admin center active users report and sort by last sign-in. In Google Workspace, open Directory, Users and add the Last sign-in column. Look for anyone with no sign-in in 90 days.

Are service accounts and shared mailboxes dormant accounts?

They can be. Service accounts often show no interactive sign-ins by design, so confirm what uses them before touching them. Give each one a named owner, a documented purpose, and a long unique password stored in a password manager.

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.