Joiners, movers, leavers: bringing the Entra ID account lifecycle under control
Every directory audit reveals the same thing: accounts belonging to people who left months ago, some still active. The problem is not technical; it is a process that is not connected to HR. Yet Entra ID provides the means to detect it and to automate it.
Symptoms of a broken lifecycle
- stale accounts: no sign-in for 90 days or more, yet still enabled;
- disabled but licensed: the account is blocked, but the licence is still being paid for;
- unprocessed movers: users keep the groups and roles of their previous job;
- orphaned guests: external accounts whose inviter has left or whose project has ended, or invitations never accepted.
Each of these is either a risk (an account that can be reactivated, a password never changed) or a direct cost.
Measuring inactivity with signInActivity
The user signInActivity property exposes the last interactive, non-interactive and successful sign-in. Reading it through Microsoft Graph requires Entra ID P1 or above. Consider both sign-in types: an account may no longer sign in interactively while still using a token.
Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"
$threshold = (Get-Date).AddDays(-90)
Get-MgUser -All -Property DisplayName,UserPrincipalName,AccountEnabled,SignInActivity |
Where-Object { $_.AccountEnabled -and $_.SignInActivity.LastSuccessfulSignInDateTime -lt $threshold } |
Select-Object DisplayName,UserPrincipalName,@{n='LastSignIn';e={$_.SignInActivity.LastSuccessfulSignInDateTime}}
An account that has never signed in has no date at all: handle it separately rather than silently excluding it.
Automating with lifecycle workflows
Lifecycle workflows (Entra ID Governance) run tasks triggered by attributes such as employeeHireDate or employeeLeaveDateTime: generating a Temporary Access Pass before day one, emailing the manager, removing groups and licences, disabling and later deleting the account after departure. Templates cover joiner, mover and leaver scenarios. Their effectiveness depends on one thing: reliable HR attributes, ideally fed by provisioning from the HR system.
Tip. Without a reliable HR source, start with a monthly reconciliation between the leavers list and active accounts. It is basic, but it is evidence.
Guests, a common blind spot
Guests often escape the leaver process because they are not in any HR system. Access reviews can target inactive guests, and entitlement management can delete a guest automatically when their last access expires. Failing that, periodically cleaning up invitations left unaccepted for several months is a minimum.
Evidence for ISO 27001 and NIS2
Annex A of ISO/IEC 27001:2022 covers identity management and access rights, and the NIS2 directive lists access control and human resources security among the expected measures. In practice, the auditor will ask for:
- the written joiner, mover and leaver procedure;
- a sample of recent leavers with the matching deactivation dates;
- the stale account report and the actions taken;
- evidence that guest accounts are handled.