IA.2.081 — Disable identifiers after defined period of inactivity

What IA.2.081 means in plain English

If someone has not logged into an account in a long time — say 90 days — that account should be automatically disabled. Dormant accounts are dangerous because they can be compromised without anyone noticing. For your small company, this is most relevant for vendor accounts, old employee accounts that were not properly offboarded, and service accounts for tools you no longer use. Set a policy (90 days is standard) and configure Azure AD or your domain to auto-disable inactive accounts.

The assessment question

“Are user and service account identifiers automatically disabled after a defined period of inactivity (90 days or less) — and is this enforced technically, not just procedurally?”

How to implement IA.2.081

1. Set a formal inactivity threshold in your policy — 90 days is the CMMC-accepted standard.
2. In Azure AD, use the "Sign-in activity" report to identify accounts with no login in 90+ days; export and review quarterly.
3. For on-premises Active Directory, run the PowerShell command: Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 on a scheduled task to auto-disable accounts.
4. Configure Azure AD Access Reviews (available in Azure AD Premium P2, or manually via script in free tier) to flag stale accounts monthly.
5. Include a "last login review" step in your quarterly IT security checklist.

Evidence your assessor will ask for

• Written policy defining 90-day (or shorter) inactivity threshold
• Screenshot of inactive account report showing review was performed
• Evidence of disabled accounts (audit log of disable actions)
• Quarterly calendar entry or task record for scheduled account review

More Identification & Authentication controls