Active Directory & Entra ID Account Cleanup Checklist Template

What the Active Directory Cleanup Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope, Baseline & Safeguards

   5 tasks

   The first answer decides whether the on-premises tasks appear. The deletion approver is named here too.

   • Record the directory setup and the scope of this run — hybrid with on-premises AD synced to Entra ID, or cloud-only; domains, OUs and tenants included
   • Confirm the AD Recycle Bin is enabled before anything is deleted — it needs the Windows Server 2008 R2 forest functional level, and enabling it cannot be undone
   • Agree the inactivity threshold and the exclusion list — Microsoft suggests 90 to 180 days suits many organisations; exclude emergency access accounts and people on long leave
   • Export a baseline of users, computers, groups, guests and devices — the before-picture for the report and for any restore
   • Tell the service desk when the cleanup runs — so an “account disabled” call is recognised and routed straight away
2. 2
   Phase 2

   Phase 2: On-Premises Users & Computers

   5 tasks

   Appears only when there is an on-premises Active Directory.

   • Find enabled users whose lastLogonTimestamp is older than the threshold — the value runs 9 to 14 days behind by design, so short thresholds give false positives
   • Find computer accounts inactive beyond the threshold — check them against the asset register first; a laptop in a drawer is still an asset
   • List accounts already disabled and the date each was disabled — accounts left disabled for years still carry their group memberships
   • Review accounts whose passwords never expire — each needs a named owner and a reason, or it joins the disable list
   • Check the default Users and Computers containers and empty OUs — the containers cannot take their own group policy, so objects there miss OU-level settings
3. 3
   Phase 3

   Phase 3: Entra ID Users, Guests & Devices

   6 tasks

   Task 2 appears only for hybrid directories.

   • Export signInActivity for every user — lastSuccessfulSignInDateTime needs Entra ID P1 or P2; a blank means no sign-in on record
   • Handle synced accounts in AD, not in Entra ID — delete a synced user only in the cloud and the next sync can bring it back
   • Review guests by last sign-in and sponsor — ask the inviting team whether each is still needed
   • Find stale devices by their activity timestamp — it updates only about every 14 days, so Microsoft advises against treating anything under 21 days as stale
   • Back up BitLocker recovery keys and retire devices in Intune or your MDM first — deleting the Entra device deletes its keys with it
   • Keep Autopilot and other system-managed devices off the deletion list — once deleted, they cannot be reprovisioned
4. 4
   Phase 4

   Phase 4: Groups, Service Accounts & Apps

   5 tasks

   Task 3 appears only when there is an on-premises Active Directory.

   • List empty groups and groups with no owner — ask the team named in the description, then assign an owner or delete
   • Check every service account has an owner, a purpose and a review date — CIS Controls v8.1 Safeguard 5.5 asks for this review at least quarterly
   • Move suitable services to group Managed Service Accounts — Windows then manages the password, so nobody rotates it by hand
   • Review app registrations for expired and long-lived client secrets — Microsoft caps secrets at 24 months, recommends under 12, and prefers certificates in production
   • Remove app registrations with no owner and no recent sign-ins — confirm with the business first; a yearly job can look idle for months
5. 5
   Phase 5

   Phase 5: Privileged Access

   5 tasks

   Task 1 appears only when there is an on-premises Active Directory.

   • List members of Domain Admins, Enterprise Admins and Administrators — Microsoft’s guidance is that membership is needed only for build and disaster recovery work
   • Count Global Administrator assignments — Microsoft recommends fewer than five, plus two cloud-only emergency access accounts
   • Check privileged Entra roles are held by cloud-only accounts — Microsoft advises against using synced on-premises accounts for them
   • Confirm every admin account belongs to a current, named person — shared admin logins and leavers’ admin accounts go first
   • Test that the emergency access accounts still sign in — and that every past use of them was recorded
6. 6
   Phase 6

   Phase 6: Disable, Wait, Approve & Delete

   5 tasks

   Task 4 is an approval. The named approver signs off the deletion list, and nothing is deleted until they do.

   • Disable the agreed candidates and record the date and reason — stamp the description so anyone who finds the account knows why
   • Remove licences from disabled accounts — a disabled account can still hold a paid licence
   • Hold for the grace period and deal with anyone who objects — 30 days is a common default; re-enable with a ticket and add to the exclusions
   • Approve the deletion list — the named approver checks it against the grace-period log and records the decision
   • Delete the approved objects — AD can restore them for the deleted object lifetime, usually 180 days; Entra keeps deleted users for 30
7. 7
   Phase 7

   Phase 7: Record & Report

   4 tasks

   • Complete the removal log — object, type, last activity, disabled date, deleted date and approver
   • Compare object counts with the baseline — users, computers, groups, guests and devices, run on run
   • Send each pattern back to the process that caused it — leavers found here mean offboarding missed a step
   • Set the date of the next run — CIS Controls v8.1 Safeguard 5.1 asks for accounts to be validated at least quarterly