Dormant Accounts

What is a dormant account?

Dormant accounts are user accounts that belong to a current, legitimate user but have not been used for a defined period, for example 30, 60 or 90 days depending on the system. The owner still works for the organization and the access may still be justified, yet nobody signs in. That silence is the problem: a takeover goes unnoticed, and the account often keeps a paid license.

Key takeaways

• Dormant accounts belong to current users who have not signed in for a defined period, unlike orphaned accounts, which no longer have a valid owner.
• The inactivity threshold for dormant accounts is set per system, for example 30 days for an admin console and 90 days for a low-risk tool.
• A dormant account combines two costs: a takeover goes unnoticed because the owner is not signing in, and the seat is often still paid.
• NIST SP 800-53 control AC-2(3) asks organizations to disable accounts inactive for an organization-defined period, within an organization-defined time period.

How dormant accounts are handled

• Set a threshold per system: decide how many days without a sign-in make an account dormant, with shorter periods for privileged or sensitive applications.
• Detect: compare the last sign-in date of each account with the threshold, in the identity provider and in every application with local logins.
• Notify the owner: ask the user and their manager whether the access is still needed, with a deadline for the answer.
• Disable: disable the account rather than delete it, so it can be restored if the owner needs it again, and record the decision.
• Remove the license: release or reassign the seat, then delete the account after the retention period set in the access policy.

Dormant account or orphaned account: what is the difference?

• Dormant account: the owner is a current employee or contractor, but the account is unused. The question is whether the access is still needed.
• Orphaned account: the owner has left or cannot be identified, so nobody is accountable. The answer is almost always removal.

Control AC-2(3), Disable Accounts, in NIST SP 800-53 Rev. 5 treats inactivity as a trigger of its own: it asks organizations to disable accounts within an organization-defined time period when they have been inactive for an organization-defined period, among other conditions. Some accounts are dormant by design, such as break-glass accounts or those of people on long leave. Document them as exceptions instead of disabling them.

Examples and use cases

A 200-person company reviews its 60 SaaS applications every quarter. With a 90-day threshold, it finds, for example, 85 dormant accounts: sales reps who stopped using a prospecting tool after a pilot, designers with a seat in a second design suite, and an engineer with admin rights in a cloud console she has not opened since changing teams. That last case is privilege creep showing up as dormancy.

Each account ends with a decision: keep, disable or remove. Corma keeps an inventory of the accounts and licenses in each SaaS application, runs access reviews with audit evidence in which managers confirm or revoke dormant access, then deprovisions through workflows, including in apps without SCIM, so that released seats feed license reclaim.

Related concepts

• Orphaned accounts
• Access review
• Deprovisioning
• License reclaim
• Privilege creep
• Corma automated access reviews

FAQ

How many days before an account is considered dormant?

There is no universal number. Each organization sets the threshold per system, often 30, 60 or 90 days, with shorter periods for privileged access.

What is the difference between a dormant account and an orphaned account?

A dormant account has a current owner who no longer uses it. An orphaned account has no valid owner at all, usually because the person has left the organization.

Should dormant accounts be disabled or deleted?

Disabled first. Disabling stops sign-ins and keeps the account restorable, and deletion follows after a retention period defined in the access policy.

Do dormant accounts still cost money?

Often, yes. In per-seat SaaS applications, dormant accounts keep their paid license until they are disabled and the seat is released or reassigned.

Request a demo