Dormant accounts: licensed users who haven't signed in for 90+ days

Somewhere in your tenant there is an account that last signed in months ago and still carries a paid licence. Often it belongs to someone who left the company. The account was disabled — or worse, it wasn't — and the licence stayed assigned, renewing quietly ever since. Nobody notices, because no admin center puts "licence assigned" and "last sign-in" on the same screen.

How accounts go dormant

Dormant licensed accounts are almost never negligence — they are the predictable residue of normal company events that each end halfway:

Where the data lives: signInActivity

Entra ID records exactly what you need in one property: signInActivity on the user object, which carries lastSignInDateTime (interactive) and lastNonInteractiveSignInDateTime. Cross it with assignedLicenses and accountEnabled and the whole report falls out. Three details matter:

• Use the later of the two timestamps. A user whose apps refresh tokens daily is not dormant, even if they never see a login page. Judging on interactive sign-ins alone flags active people.
• An empty value means never. Users with a licence and no sign-in activity at all never used the seat once — the safest reclaims on the list.
• The log only goes back so far. Sign-in logs retain 30 days on Entra ID P1; the signInActivity property persists beyond that, which is why the report should read the property, not the logs.

Triage: three buckets, three actions

Reclaim now. Disabled accounts still holding a paid SKU, and accounts that never signed in at all. There is no user to upset — the person is gone or never arrived. Reclaim the licence, keep the identity if retention policy needs the mailbox data. This bucket is pure savings and usually the largest.

Review with HR. Enabled accounts with no sign-in for 90+ days. This list needs human context before you act: parental leave, long sick leave and sabbaticals are legitimate dormancy; the contractor whose engagement ended in the spring is not. Send the list to whoever knows, once a month, and act on the answers.

Keep — but check the size. Active users are out of scope for this report, with one asterisk: activity proves the seat is needed, not that the SKU is right. That is a separate audit — the broader sweep is covered in our licence waste audit guide.

Make it a report, not a project

The audit is a one-time win; the process gap that created it is still there, refilling the list at the rate people leave. The durable fix is a standing report — licensed users × account state × last sign-in — reviewed monthly. GraphPaaS keeps exactly that view per tenant, refreshed automatically: dormant and never-signed-in users are already flagged with their SKUs when you log in, so the monthly review is reading a list, not building one. For MSPs, the same report exists for every tenant you manage, side by side.