Administrators with anomalous sign-in patterns
Identifies administrator accounts that have never signed in or show unusual sign-in patterns.
How to fix it
Review administrator accounts that have never signed in or show unusual sign-in behavior. Inactive admin accounts can be abused.
Required Microsoft Graph permissions
EntraAnalyzer needs the following read-only Graph permissions to evaluate this rule:
Directory.Read.AllAuditLog.Read.AllRoleManagement.Read.Directory
Further reading
Run this check on your tenant
EntraAnalyzer evaluates this rule automatically on every scan and emails you the results.
Get started — free first scan →