M365Clarity · Stale Accounts
Former employees, contractors, and service accounts that were never properly offboarded remain active in Microsoft 365 indefinitely. They hold valid credentials, may have mailboxes, SharePoint access, and Teams memberships, and represent unnecessary exposure. An attacker who obtains credentials for a forgotten service account may find that nobody notices unusual activity for months.
The Stale Accounts tab scans your tenant for user accounts that haven't had any sign-in activity within the last 30, 60, or 90 days. It surfaces the account, their assigned licences (so you can see whether you're paying for access that's not being used), and their last sign-in date. Accounts with licences but no recent activity are the highest priority for review.
Licence waste: Each stale account with an assigned Microsoft 365 licence costs you money every month. A 50-person tenant with 5 forgotten licensed accounts is paying for over £200/year in unused licences depending on the plan.
The right action depends on the account type. For former employees, accounts should be blocked from sign-in and licences removed immediately — Microsoft 365 retains data for 30 days after the account is deleted by default, or longer with a litigation hold. For service accounts, investigate whether the service is still in use before removing access. For accounts that haven't signed in for 90+ days with no clear owner, raise with the business before blocking.
The best long-term solution is to configure access reviews in Microsoft Entra ID so that managers are automatically asked to confirm whether their team members still need access on a quarterly basis. This keeps your tenant clean without requiring manual periodic audits.
M365Clarity scans your Microsoft 365 configuration and shows you exactly what's in your plan, what's configured, and what's sitting idle — in plain English.
Start free scan → View live demoRelated articles