--- title: "Are all accounts associated with legitimate processes or current users (no orphaned/stale)?" url: https://insuranceposture.com/questions/access-control/accounts-associated-legitimate-processes-current-users category: "Access control and privilege" canonical_key: q_idn_007 evidence_state: verified updated: 2026-08-24 --- # Are all accounts associated with legitimate processes or current users (no orphaned/stale)? URL: https://insuranceposture.com/questions/access-control/accounts-associated-legitimate-processes-current-users Section: Access control and privilege Evidence state: Verifiable from your tenant Dormant accounts are the quietest exposure on any estate. Nobody notices when one is used, because nobody was watching an account nobody uses. ## What the carrier is actually asking The carrier is asking whether your directory reflects reality: no accounts for people who left, no accounts for projects that ended, no service accounts whose purpose nobody can name. It is a question about identity hygiene, and it is asked because dormant accounts are disproportionately represented in intrusion timelines. ## Why it is underwritten A stale account has three properties an attacker values: an old password that predates your current policy, no owner to notice unusual behaviour, and often a set of permissions accumulated before it went quiet. Credential stuffing and password spraying find these accounts first. Underwriters ask because the control is cheap and its absence is a reliable indicator of weak identity governance more broadly. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is one of the most directly measurable questions on any application. Entra ID records last sign-in per account, so staleness is a query rather than an opinion. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Entra ID | User accounts with last interactive sign-in older than the threshold you set | A small, explained population. Accounts dormant beyond ninety days should be disabled or justified | | Entra ID | Accounts that have never signed in | Provisioned and abandoned accounts are removed, since they carry an initial password and no observation | | Entra ID | Guest and external accounts, and their last activity | Guests from finished engagements are removed. Guest sprawl is the most common form of this finding | | Entra ID | Applications and service principals without an assigned owner | Every application has a named owner, so credentials have someone accountable for rotating them | | Microsoft 365 | Licensed accounts with no mailbox activity, and orphaned Teams or sites | Licensed dormancy is both a cost and a risk signal, and orphaned collaboration spaces retain data with no owner | **Disabled is not deleted, and that is fine** Carriers do not require deletion. Disabling on departure, with retention for legal and forensic reasons, is a mature answer. What they do not accept is enabled accounts belonging to people who left, which is what an unmanaged directory produces. ## What a defensible yes requires - A defined dormancy threshold exists and accounts crossing it are disabled automatically or reviewed on a schedule. - Departure triggers deprovisioning through a process that runs whether or not anyone remembers to file a ticket. - Guest accounts have expiry or periodic review, so external collaboration does not become permanent access. - Service accounts and applications have named owners and a purpose recorded somewhere durable. - The current stale count can be produced on demand rather than reconstructed for the application. ## How this answer goes wrong The answer usually goes wrong at the boundary of the identity system. Human resources triggers deprovisioning for employees and not for contractors, so contractor accounts persist. Or the process disables the account and leaves the mailbox and the guest invitations in other tenants intact. The question asks about all accounts, and the accounts that survive a departure process are precisely the ones nobody sees. ## If this answer turns out to be wrong Privileged access answers are read alongside the multi-factor block, and an inaccuracy here is usually argued the same way: that an accurate answer would have changed the terms. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how materiality is decided](https://insuranceposture.com/glossary/materiality). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### What counts as stale? Most organisations use ninety days without an interactive sign-in, and carriers rarely dispute that. What matters more is that the threshold is defined, enforced, and the same one you can evidence. ### Do service accounts count as orphaned if nobody owns them? Yes, and they are the more serious version of this finding. A service account with no owner has no one to rotate its credential or notice its misuse. ### How do guests fit into this? Guest accounts are usually the largest stale population in a Microsoft 365 tenant, because invitations outlive the projects that produced them. Access reviews or automatic expiry solve it. ### Is this asked in a claim review? Frequently, because intrusion timelines so often begin at an account that should not have existed. It is an easy control to evidence before a loss and an uncomfortable one to explain after. ## Related questions - [Does the Applicant terminate computer access promptly when employee/contractor leaves?](https://insuranceposture.com/questions/governance-and-workforce/applicant-terminate-computer-access-promptly-when-employee-contractor-leaves) - [How many domain and service accounts are in the Domain Admin Group?](https://insuranceposture.com/questions/access-control/domain-service-accounts-domain-admin-group) - [Is access restricted on a least-privilege basis to network, Personal Information, and Critical Information?](https://insuranceposture.com/questions/access-control/access-restricted-least-privilege-basis-network-personal-information-critical) - [Are changes to administrator accounts reported automatically?](https://insuranceposture.com/questions/access-control/changes-administrator-accounts-reported-automatically) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.