New security assessment: Remove inactive service accounts
Analysis / inference: Microsoft Defender for Identity has introduced a new security assessment to identify and flag Active Directory service accounts that have been inactive for 90 days.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new archive · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
A new security assessment has been added to the Defender for Identity portal that specifically targets inactive service accounts.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisUnused service accounts represent a significant attack surface, as they are often overlooked during credential rotation and can be exploited by attackers to maintain persistence or move laterally without triggering standard user-based alerts.
Security teams can now proactively identify and remove stale accounts, reducing the risk of credential abuse.
Section 03 · Recommended actions
- Access the Microsoft Defender portal
- Review the 'Remove inactive service accounts' report
- Verify identified accounts with application owners
- Disable or remove confirmed inactive accounts
- Navigate to the Microsoft Defender portal
- Check the Identity security posture dashboard
- Review the list of identified inactive service accounts for potential business impact before removal