Find dormant and inactive accounts in Microsoft 365
Accounts of former employees, temporary staff or tests can stay active while nobody uses them anymore. AlertControl shows per user when they last signed in, themselves or in the background, and when the password was changed. Sort on last sign-in and you immediately see which accounts have been idle for months.
Updated 30 October 2026
Why are dormant accounts a risk?
An account that nobody uses does not stand out when it is misused. If the password is old and MFA is missing, it is an easy target. The risk is greater for accounts with administrator rights or access to shared mailboxes and files.
What does AlertControl show?
The Users & MFA tab shows per user the last interactive sign-in (the user signed in themselves), the last non-interactive sign-in (an app or synchronisation in the background) and the last password change. Sort ascending on one of those columns to put the oldest at the top; accounts that never signed in are at the bottom with a dash. The optional AI advice also looks at accounts that have not been used for more than 90 days.
What do you need?
Microsoft only releases the last sign-in per user if at least one user in your tenant has Microsoft Entra ID P1. Without that licence the sign-in columns stay empty; you do still see the last password change.
Frequently asked questions
There is no fixed threshold. A common threshold is 90 days without a sign-in as the moment to review an account; AlertControl's AI advice uses the same threshold.
With an interactive sign-in the user signs in themselves, for example with a password and MFA. A non-interactive sign-in is done by an app or service in the background with an existing token, for example Outlook or OneDrive synchronising.
No. AlertControl only has read access. You block or delete an account in the Microsoft 365 or Entra admin center.
See for yourself what is happening in your Microsoft 365?
Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.