How do accounts become orphaned?
- A leaver had an account in an app outside single sign-on, and nobody knew to disable it.
- A contractor's end date lived in a contract, and the account outlasted the work.
- The owner of a service account left, and nobody took it over.
- A test or project account stayed behind after the project ended.
Why are orphaned accounts a risk?
An orphaned account holds valid credentials that nobody watches. If someone signs in with it, no owner notices or complains. Attackers prefer valid accounts for exactly that reason.
They also distort your audit evidence. A review cannot ask the right person about access when that person no longer exists.
How do you find and fix orphaned accounts?
- Compare every account in each app against your HR records and your directory.
- Check the last sign-in date for each account that has no match.
- Give each one that is still needed a named owner.
- Disable the rest, then delete them after a waiting period you agree with the business.
- Add the cases you found to your leaver checklist. The same gap should not open twice.
Frequently asked questions
What is the difference between an orphaned account and a dormant account?
A dormant account has not signed in for a long time. An orphaned account has no owner. One account is often both, and that pairing is the riskiest kind.
How often should you look for orphaned accounts?
At every access review, and after every leaver. A monthly comparison against your HR records catches the ones a process missed.