Inactive-user guide
How to Find Inactive Users in Microsoft 365 Without Guessing
A practical method for identifying inactive Microsoft 365 users, interpreting activity evidence, and avoiding false positives.
Choose the definition before running the report
There is no universal inactivity threshold. Sixty days may fit a fast-moving company, while ninety or more may be safer for seasonal teams. Apply the same documented threshold across reviews and define which activity signals count.
Microsoft's Office 365 active-user detail report supports 7-, 30-, 90-, and 180-day reporting periods. A longer period reduces short-term false positives, but business context is still required.
Separate three different results
A useful report should not collapse every account into active or inactive. The evidence is clearer when it distinguishes confirmed activity, confirmed inactivity within the available report, and unknown activity where the source did not provide enough data.
- Active: relevant activity appears inside the selected review window.
- Review candidate: the report provides sufficient evidence that activity falls outside the threshold.
- Unknown: activity data is absent, unavailable, de-identified, or otherwise insufficient for a conclusion.
Investigate exceptions before changing access
Check the account with the responsible manager or system owner. Pay special attention to employees on leave, newly created accounts, service and automation accounts, shared resources, synchronized identities, and people whose work uses a product not covered by the selected report.
Microsoft notes that sign-in timestamps can have reporting delay and that different sign-in fields carry different meanings. A timestamp alone should not bypass an organization's offboarding, retention, security, or legal process.
Turn the list into an auditable workflow
Assign an owner and disposition to each candidate: retain, investigate, reassign, remove, or exempt until a date. Keep the evidence window and pricing assumptions with the review. After administrators make approved changes, verify assignment totals and billing separately.
- Never treat “no activity found” as automatic approval to remove a license.
- Use least privilege for any reporting tool that connects to the tenant.
- Avoid emailing employee-level activity lists when an aggregate summary is sufficient.
- Repeat the review on a predictable schedule and compare changes over time.
How SeatSaver handles inactivity
SeatSaver uses a configurable threshold and labels insufficient evidence as unknown rather than inactive. Account-level candidates are returned for the authorized review session, while saved scan history and scheduled emails contain aggregate totals only. SeatSaver has no permission to change a Microsoft 365 account or license.
Frequently asked questions
What is a good Microsoft 365 inactivity threshold?+
Many organizations begin with 60 or 90 days, but the correct threshold depends on seasonality, leave policies, risk, and how the organization uses Microsoft 365.
Why can Microsoft 365 activity be unknown?+
The reporting source may omit a user, lack enough history, be unavailable, or provide data that does not support a confident conclusion. Unknown should remain separate from inactive.
Should inactive users be deleted?+
Not based on an activity report alone. Follow the organization's identity, offboarding, retention, and legal procedures before disabling an account or changing licenses.
Run the review without giving up control.
SeatSaver turns Microsoft 365 inventory and activity evidence into a read-only review. Your administrators make every final decision.
Primary references
- Microsoft Graph: Office 365 active-user detail
- Microsoft Entra: manage inactive accounts
- Microsoft Graph: sign-in activity
Educational content only. Confirm Microsoft behavior, licensing terms, and organizational requirements before changing access or subscriptions. SeatSaver 365 is independent of Microsoft.