Inactive Microsoft 365 accounts in an SME: when to disable them

What “inactive” does and does not mean

In the Microsoft 365 tenant you see accounts as enabled or disabled, with or without an assigned licence. “Inactive” is a rule you set yourselves: for example no successful sign-in in the last 60 or 90 days. That is not the same as:

• Disabled: the user can no longer sign in; the mailbox and OneDrive often still exist until you clean up further.
• Deleted: the object goes away (with a soft-delete window); recovery is time-bound.
• Licence removed: the person may lose Exchange/Teams/Office features while the account object still exists — useful for cost, not a substitute for clean offboarding.

Clear language stops someone saying “inactive” while the account is still enabled with a Business Premium licence.

Why an SME should fix this

Three practical reasons. Attack surface: an account nobody uses still has a password, MFA registration and often SharePoint or Teams access — until someone abuses it or an old device still holds tokens. Cost: every unused licence stays on the invoice. Process: inactive accounts are often ex-colleagues, seasonal staff or test accounts that never went through the joiner and leaver checklist. See also admin accounts: a dormant Global Admin is worse than a dormant standard user — review those first.

Shared devices and kiosk-style logins make it worse: if “nobody remembers that account”, you also no longer know which password sits on which laptop.

What you should decide in writing

Keep it short enough to decide this quarter:

• threshold: after how many days without sign-in someone becomes a candidate (for example 60 or 90), and which exceptions apply (parental leave, season, external auditor);
• who runs the monthly or quarterly review (HR, director, or together with Floor ICT);
• order: disable first, then mailbox/OneDrive policy, delete later — or convert to a shared mailbox if the address must stay;
• mailbox retention: how long mail is kept, whether to forward or delegate, and whether you convert to a shared mailbox;
• licence reclaim: when the licence leaves the account and returns to the pool;
• MFA and devices: revoke sessions, sign devices out, clean up app passwords — see also turning on MFA in Microsoft 365.

Write those points on one page. That is your account-hygiene policy; the tenant follows that text.

What Floor ICT configures — and what you decide

In the Microsoft 365 tenant we typically: produce periodic sign-in and licence lists; propose candidates above your threshold; disable after your approval; convert to a shared mailbox or apply a retention agreement; reclaim licences; and tie this to joiner/leaver processes so “forgotten accounts” appear less often. We help clean up test and generic accounts (temp01, old-intern) where those still exist.

You still decide: the day threshold, exceptions, whether disable or delete is the end step, and how long mail from a departed colleague must be kept. Technical reports without ownership do not fix “we still pay five dormant licences”; policy without execution does not either.