The "Dormant Account Remediation HyperAgent for EntraID" workflow template is designed to enhance security and compliance by identifying and managing dormant user accounts in Azure Entra ID. This automated process runs on a scheduled basis, comparing user activity against a predefined exceptions list. It generates a Torq case for tracking, sends a Slack approval request for account deactivation, and, upon approval, disables the dormant accounts. This ensures that only active and necessary accounts remain enabled, reducing potential security risks associated with unused accounts.
Use Cases
Device \u0026 User Compliance , Identity and Access Management , Suspicious User Activity
Workflow Breakdown
On a scheduled cadence, queries Microsoft Graph for all enabled accounts that have not signed in for 60+ days.
Compares results against the dormant_exception_list workspace variable table and removes any matches.
Creates a Torq case with the final list of dormant accounts.
Sends a Slack Block Kit approval message with all dormant account details.
If approved, disables each account in Entra ID
Vendors
Utils, Microsoft 365
Tips