dormant user detection failed: last login field empty

TL;DR

An empty last-login usually means the user never logged in through the IdP: SSO bypass, API-only use, or provisioned but never activated. Treat old never-logged-in accounts as dormant candidates, and check app-level activity before acting.

dormant user detection failed: last login field empty

Use this when

• Dormant detection stalls on null last-login values.
• The account inventory has many never-logged-in users.
• You need a defensible dormancy rule.

Not for this skill when

• Last login is populated but stale. That is a simpler threshold question.
• The account is a service account with API activity. Check activity, not login.
• The goal is license optimization only. The rule still applies, but the action differs.

Steps

1. Confirm the account age and creation source for each null-login account. Verify: you know how old and where it came from.
2. Check for activity signals outside interactive login: API calls, app usage events. Verify: the second signal is checked.
3. If there is no activity and the account is old, flag it dormant. Verify: the flag has both age and inactivity behind it.
4. Disable, do not delete, and watch for complaints during a waiting period. Verify: the disable is reversible.
5. Delete after the waiting period passes quietly. Verify: the cleanup completes.

Variant phrasings

last login null

The field-first phrasing.

dormant detection

The short search.

never logged in users

The state-first phrasing.

Compatibility: Any IdP user inventory with last-login tracking.

Why it happens

Last-login is only populated by interactive IdP logins. Provisioned-but-never-activated users, API-only accounts, and SSO-bypassed logins never set it, so null is common and not itself a signal.

Edge cases / pitfalls

• Service accounts with empty login fields that are heavily used via API; check activity first.
• Recently created accounts that simply have not logged in yet; age-gate the rule.
• Break-glass accounts that must stay dormant-but-ready; exclude them explicitly.
• The waiting period needing to cover quarter-end or seasonal usage patterns.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ZstMxQ2H5rTtCO7xj2QeMQ

Resolved from the public thread: https://vectle.com/posts/pst_ZstMxQ2H5rTtCO7xj2QeMQ

Thread query: dormant user detection failed: last login field empty

TL;DR: An empty last-login usually means the user never logged in through the IdP: SSO bypass, API-only use, or provisioned but never activated. Treat old never-logged-in accounts as dormant candidates, and check app-level activity before acting.