Support Center

Welcome
Login  Sign up

Inactive Accounts Alert

What are Inactive Account alerts


Inactive account alerts warn you of accounts that have not been in use, due to lack of activity/login, for 30 days.


Why should I monitor Inactive Accounts


Inactive accounts are a common attack vector for hackers, as no one will notice that the account is being used for infiltration.


Alert Logic


Hardcoded logic based on the following:

  • At the time of integration, we will do an immediate evaluation of any inactive accounts.  Any account inactive for 30 or more days will generate an email for you to review.
  • Users are evaluated and emails generated on a daily basis, only when there is data to be alerted on
  • User will be included in daily alert is sent if an account becomes inactive (30 days without activity/login)
  • Users will be re-included in daily alert at 30day frequency of inactivity (30, 60, 90, etc) only
  • An alert is generated only on the 30,60,90 days inactive and not 31,32,33, etc, to reduce unnecessary noise


Email Notification Layout


Subject; Inactive Account Alert for <company name>


Tenant: <company name>

Discovered on: yyyy-mm-dd

 

===========

 

Name: <user1>

Email: <email1>

Days inactive: <x days>

Admin: <yes/no>

Licenses: <M365 licenses>

MFA required: <does this account require MFA>

MFA registered: <does this account have MFA registered>

Name: <user2>

Email: <email2>

Days inactive: <x days>

Admin: <yes/no>

Licenses: <M365 licenses>

MFA required: <does this account require MFA>

MFA registered: <does this account have MFA registered>

 

--

Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.