How to automatically disable inactive Microsoft Entra ID users without affecting active AD accounts
Objective
In hybrid environments where user activity is split between Microsoft 365 (Microsoft Entra ID) and on-premises Active Directory, it's important to keep both directories clean and secure. This article explains how to set up an automation in ADManager Plus to automatically disable on-premises AD accounts when users are inactive in Microsoft Entra ID while ensuring active on-premises users remain unaffected. This helps IT teams streamline deprovisioning, reduce security risks, and maintain directory hygiene without disrupting legitimate access.
Prerequisites
ADManager Plus is installed and connected to both your on-premises ADand Microsoft 365 tenant.
Your technician account has the permission to create automations and manage user accounts.
Inactive user reporting is enabled in Microsoft 365, and AD auditing is configured to capture last logon details.
You're using a version of ADManager Plus that supports conditional automation (available in most recent builds).
Steps to disable inactive Microsoft Entra ID users without affecting active AD accounts
Log in to ADManager Plus and go to Automation > Create New Automation.
In the Automation Name field, provide a clear name for your automation.
Use the Description field to briefly explain the purpose of this automation.
Set Automation Category to User Automation.
Under Select Domain, choose the domain and OUs where the automation should run. You can exclude child OUs if needed.
For Automation Task/Policy, select Disable Users.
In the From Reports drop-down:
Select Microsoft 365 Reports as the category, then choose the Inactive Azure AD Users report.
Customize the inactivity period based on your policy.
Check both Exclude Active AD Users and Exclude objects modified by the previous execution of this automation.
Click OK to save the report selection.
Set the schedule under Run at. Choose how frequently the automation should run (e.g., hourly, daily, weekly, monthly, or a custom interval).
Enable Notifications to alert stakeholders via email or SMS.
Click the Edit icon to select or create a notification template.
To avoid multiple alerts per task, check the Send only Consolidated Report option while creating the template.
Click Save to schedule the automation or Save & Run to execute it immediately.
After execution, go to Reports > User Reports > Account Status Reports > Disabled Users to verify the results or click the
icon to see the automation history and details.
Tips
Enable Implement Workflow to avoid accidental disables during initial rollout.
Periodically review and update your business rules and report filters to ensure they align with current security policies.
Maintain a list of excluded accounts, such as VIPs or service accounts, that may show up as inactive but should not be disabled.
New to ADSelfService Plus?
Related Articles
The manager attribute does not sync to Microsoft Entra ID via DirSync after user creation using ADManager Plus
Issue description When a new user is created using ADManager Plus, the Manager field is correctly populated within the Active Directory. However, after synchronization via DirSync or Microsoft Entra Connect, the Manager attribute is not reflected in ...Microsoft 365 license management using ADManager Plus
This article will explain how you can assign and revoke Microsoft 365 licenses using ADManager Plus. With ADManager Plus, you can: Assign Microsoft 365 licenses while creating users. Modify Microsoft 365 licenses for existing users. Remove Microsoft ...How can I delegate permissions to help desk technicians to enable MFA for Microsoft 365 users?
Objective This article explains how to delegate permissions in ADManager Plus so that help desk technicians can enable or manage multi-factor authentication (MFA) settings for Microsoft 365 users. This delegation ensures that routine MFA ...Extending the Password expiry of users
ADManager plus uses the LDAP attributes of users and other objects to manage and generate reports. However, the password expiry of users is not a direct LDAP attribute in Active Directory. Instead, it is calculated based on the pwdLastSet attribute ...How to configure UKG Pro Active Directory integration in ADManager Plus
Objective This article explains how to set up a seamless UKG Active Directory integration using ManageEngine ADManager Plus to automate user identity life cycle management. By connecting UKG Pro with Active Directory, IT teams can eliminate manual ...