Dormant Admins
Define when admins are considered dormant.
Adding a baselineConfigure it
This baseline applies per user, through a user-level scheme or an Azure group rather than to the tenant as a whole. Apply it so it reaches your administrator accounts, and Octiga flags any admin who’s stopped signing in.
-
Add it directly to a user or an Azure group (Adding a baseline), or bundle it into a user-level scheme and deploy that to the groups covering your admins (Deploying a scheme). See Groups and priority for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.
-
Set how many months without a sign-in counts as dormant. It’s the only setting on this baseline, and the longest you can set is six months.
-
Keep break-glass accounts out of it. An emergency-access admin account is deliberately left unused between emergencies, so it always looks dormant; leave it out of the group or scheme that carries this baseline so it doesn’t raise a deviation every cycle.
-
Save. This baseline only reports what it finds and writes nothing back to Microsoft 365, so there’s no Auto-remediation switch.
Check it worked
Passing means the admin has signed in within the window you set; Deviated means they haven’t. To check the last sign-in yourself, go to Identity → Users in the Microsoft Entra admin centre, select the user and open Sign-in activity. On the user roster or a group’s member list, Passing shows as a green dot for this baseline; Deviated (red) means the account has gone quiet; Excluded (grey) means the user or tenant isn’t licensed for Entra ID P1 or P2.
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.