Shedding Light on Dormant Sensitive Accounts

Tue, 08 Jul 2025 15:34:54 +0000

Dormant sensitive accounts are a high-risk identity exposure. In Microsoft Defender XDR, the recommendation Remove dormant accounts from sensitive groups helps surface these accounts, including whether they are inactive, disabled, or have expired credentials.

You can export the detected entities, but the export often contains limited context. In many cases, you only get entity names or SID values, which makes remediation harder when you need ownership and organizational details.

A practical approach is to use the SID values to enrich the result set with identity attributes from IdentityInfo. You can quickly build a SID variable list using KustoVars, then query Defender XDR for additional context.

Account Security on Anything About IT

Shedding Light on Dormant Sensitive Accounts