An unused Microsoft 365 login, an old payroll portal profile or a former contractor’s remote-access account may look harmless. In practice, each can be an open route into business systems, sensitive client data and shared files. Knowing how to manage inactive accounts is therefore a core part of everyday IT security, not merely an admin tidy-up.
For small and mid-sized businesses, inactive accounts often build up quietly. Staff leave, roles change, projects end and software subscriptions evolve. Unless somebody owns the process, access remains in place long after there is a business reason for it. The result is unnecessary risk, avoidable licence costs and confusion when an urgent issue needs resolving.
What counts as an inactive account?
An inactive account is any user profile that is no longer being used as intended but can still access a system. It may belong to a leaver, a long-term absent employee, a temporary worker, a shared mailbox, an old administrator profile or a dormant supplier login.
The definition should not be limited to accounts with no recent sign-in. Some accounts rarely log in by design, such as service accounts used by backup software, monitoring tools or line-of-business applications. Disabling one without checking its purpose can interrupt backups, reporting, email delivery or essential operations.
A practical policy distinguishes between three situations: accounts that are genuinely no longer needed, accounts that are temporarily unused, and technical accounts that require controlled ongoing access. This avoids the common mistake of treating every dormant profile in exactly the same way.
Why inactive accounts create a business risk
Old accounts are attractive to criminals because they can be overlooked. A former employee may still know a password, a mailbox may hold useful information for phishing attempts, or an account may not have multi-factor authentication enabled. If credentials have been exposed elsewhere, an unused login could become a simple entry point.
There are operational consequences too. When several people have inherited access to the same folders, software or admin panels, it becomes difficult to establish who changed something. That slows troubleshooting and weakens accountability. It can also leave businesses paying for licences assigned to people who left months ago.
For organisations handling personal, financial, health or student information, access control has a compliance dimension. Under UK GDPR principles, personal data should only be accessible to people who need it for a defined purpose. Retaining unnecessary access makes it harder to demonstrate good governance if a customer, regulator or insurer asks how information is protected.
How to manage inactive accounts with a clear process
The best approach is a repeatable account lifecycle process rather than a one-off clean-up. It should cover joining, role changes, absence and leaving, with named responsibility at every stage.
Start with a complete account inventory
List every system where a person, supplier or application can sign in. For many businesses, this includes Microsoft 365, email, cloud storage, accounting platforms, CRM systems, VoIP, remote access, Wi-Fi management, website administration, antivirus consoles, backup portals and line-of-business software.
Do not rely on one staff list or a single directory. Employees can have separate logins across several services, and older systems may not be connected to central identity management. Compare the account list against current HR or management records, then record an owner and purpose for every account that remains active.
The inventory should show the user name, system, permission level, last sign-in where available, manager or business owner, account type and review date. This gives you evidence for decisions rather than relying on assumptions.
Act quickly when someone leaves or changes role
A leaver process should begin on the final working day, or earlier where circumstances require it. Disable access to email, Microsoft 365, remote desktop, VPN, business applications and mobile device management. Remove the person from distribution groups, shared mailboxes, Teams channels and shared folders where their access is no longer needed.
Disabling is usually safer than immediate deletion. It preserves information and gives managers time to confirm whether files, mail or customer records need to be transferred. Set an agreed retention period, then delete the account and revoke licences once the review is complete.
Role changes need equal attention. An employee moving from finance to operations, for example, should not automatically retain access to financial systems. Grant the access required for the new role and remove access that no longer has a clear business purpose.
Secure temporary and external access
Contractors, consultants, IT suppliers and agency staff often need short-term access. These accounts should have an expiry date from the start, rather than relying on someone to remember to remove them later. Restrict permissions to the specific system and task wherever possible.
Avoid shared usernames for third parties. Individual accounts create an audit trail and make it straightforward to remove one person without affecting others. Where a shared account cannot be avoided for a legacy system, change the password whenever a user leaves the arrangement and keep a tightly controlled record of who has access.
Treat privileged accounts differently
Administrator accounts deserve more frequent review because they can alter settings, create users and access large volumes of data. No day-to-day user should use an admin account for ordinary email, browsing or document work.
Keep admin access separate, enable multi-factor authentication and limit the number of people who hold it. A former administrator account should be disabled immediately, even if other accounts are being reviewed in stages. For critical systems, consider alerts for privileged sign-ins so unusual activity is noticed quickly.
Set review dates rather than waiting for a problem
A monthly check is sensible for high-risk systems such as email, finance, remote access and administrator portals. A quarterly review may be appropriate for lower-risk software, depending on how often staff and suppliers change. The right frequency depends on your sector, the sensitivity of your data and the size of your team.
Use reports showing last login, inactive licences and accounts without multi-factor authentication. Then ask managers to confirm that each user still needs access. Managers are often best placed to spot a departed contractor or a staff member who changed role, while IT can validate the technical impact of removing access.
Document each review. A simple record of what was checked, what was disabled and who approved exceptions creates accountability. It is also useful when renewing software licences, responding to a security questionnaire or investigating an incident.
Avoid deleting accounts too early
Removing access and deleting data are different actions. An immediate deletion may destroy emails needed for a client handover, records required for retention, or files that only the departing employee knew about. It can also make it difficult to investigate suspicious activity later.
Set retention periods that reflect your legal obligations, contracts and internal policies. During that period, preserve the account securely, redirect business email if appropriate and assign ownership of relevant documents. Once the retention period expires, remove the account, licence and associated data in a controlled way.
This is also why forwarding a former employee’s entire mailbox indefinitely is rarely a good solution. It can expose private or confidential correspondence to people who do not need to see it. A managed shared mailbox or a clearly defined autoresponse is often more appropriate, but the choice should reflect the role and business need.
Make account management part of your wider security plan
Inactive-account management works best alongside strong passwords, multi-factor authentication, device management, reliable backups and staff awareness training. If an old account is missed, these controls can reduce the chance that it becomes a serious incident. They do not remove the need to close access promptly.
For businesses without an internal IT team, the challenge is usually ownership. HR may know when people leave, managers may understand access needs, and an IT provider may control the systems, but the process can fail if those parties do not communicate. Agree who notifies whom, how quickly changes must be made and who signs off exceptions.
Trust PC Expert can help businesses review user access, remove unnecessary accounts and put practical offboarding procedures in place across core systems. The aim is not to add bureaucracy. It is to make security and daily administration easier to manage as the business grows.
A well-managed account list should never be a mystery discovered after an incident. Give every account an owner, a reason to exist and a review date, and your business will be in a much stronger position when people, suppliers or systems change.
