# Dormant Admins

> Define when admins are considered dormant.

Define when admins are considered dormant.

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group rather than to the tenant as a whole. Apply it so it reaches your administrator accounts, and Octiga flags any admin who's stopped signing in.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or bundle it into a user-level scheme and deploy that to the groups covering your admins ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.
2. Set how many months without a sign-in counts as dormant. It's the only setting on this baseline, and the longest you can set is six months.
3. Keep break-glass accounts out of it. An emergency-access admin account is deliberately left unused between emergencies, so it always looks dormant; leave it out of the group or scheme that carries this baseline so it doesn't raise a deviation every cycle.
4. Save. This baseline only reports what it finds and writes nothing back to Microsoft 365, so there's no **Auto-remediation** switch.

> **Licence: Entra ID P1 or P2:**

## Check it worked

Passing means the admin has signed in within the window you set; Deviated means they haven't. To check the last sign-in yourself, go to **Identity → Users** in the Microsoft Entra admin centre, select the user and open **Sign-in activity**. On the user roster or a group's member list, Passing shows as a green dot for this baseline; Deviated (red) means the account has gone quiet; Excluded (grey) means the user or tenant isn't licensed for Entra ID P1 or P2.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)