Identity
Cloud Security
Best Practices
Identifying 'Stale' Accounts: The Low-Hanging Fruit of Cloud Security
ThreatMate Team
Jun 15, 2023
4 min read
What Are Stale Accounts?
Stale accounts are user accounts that are no longer actively used: - Former employees - Contractors whose projects ended - Service accounts for decommissioned systems - Test accounts that were never removed
Why Stale Accounts Are Dangerous
Attack Surface Every account is a potential entry point. Stale accounts: - May have weak or known passwords - Often lack MFA - Aren't monitored for suspicious activity - May retain excessive permissions
Compliance Risk Regulations often require prompt deprovisioning: - HIPAA - SOX - PCI-DSS - GDPR
How to Identify Stale Accounts
Microsoft 365 - Review sign-in activity reports - Check for accounts with no sign-ins in 90+ days - Compare against HR records
Active Directory - Query lastLogonTimestamp - Review group memberships - Check for password age
Cloud Platforms - IAM access analyzer - CloudTrail/audit logs - Console sign-in history
Remediation Process
- Identify — Find accounts with no recent activity
- Verify — Confirm the account is truly stale
- Disable — Disable before deleting (reversible)
- Document — Record actions for compliance
- Delete — Remove after retention period
ThreatMate helps identify stale accounts across M365 and cloud environments.
Ready to secure your attack surface?
See how ThreatMate helps MSPs identify and remediate vulnerabilities across their client base.
