Disabled users still assigned to roles
Detects disabled user accounts that are still members of directory roles
How to fix it
Remove disabled users from all directory roles as part of the off-boarding process.
Required Microsoft Graph permissions
EntraAnalyzer needs the following read-only Graph permissions to evaluate this rule:
Directory.Read.All
Further reading
Run this check on your tenant
EntraAnalyzer evaluates this rule automatically on every scan and emails you the results.
Get started — free first scan →