agent's access review approved dormant accounts: inactivity filter

agent's access review approved dormant accounts: inactivity filter

TL;DR

The access review approved accounts that have not logged in for months, because the review showed names without activity. Add last-login to the review data and auto-flag dormant accounts for removal. Certifying a dormant account is certifying an attacker's foothold.

agent's access review approved dormant accounts (no inactivity filter)

Steps

1. Pull last-login for every account in the review scope. Expected: The dormant set is identified.

2. Change the review default: dormant accounts (no login in 90 days, or your policy) default to revoke, not approve. Expected: The default is safe.

3. Require justification for any dormant account that stays. Expected: Exceptions are explicit.

4. Revoke the wrongly approved dormant accounts now. Expected: The foothold closes.

5. Automate the inactivity flag in the review tooling so the next review starts filtered. Expected: The process is fixed.

When to use

• access reviews approve dormant accounts
• the review lacks activity data
• certifications feel automatic

When not to use

• the accounts are service accounts with no logins by design (different lifecycle)
• dormancy is expected (parental leave; handle as exception)
• the review already considers activity (check the data source)

Tool compatibility

• any access review process
• identity providers

Variant phrasings

• "access review approved dormant accounts"
• "inactivity filter access review"
• "dormant accounts certified"

Why it happens

Access reviews ask 'should this person have this access', and reviewers answer from names they recognize. Dormant accounts belong to people who left, changed roles, or never used the access; approving them extends attacker dwell time. Last-login turns the review from a memory test into a data decision.

Edge cases

• service accounts need their own review track; login-based dormancy does not apply
• the inactivity threshold is policy; set it deliberately
• break-glass accounts are dormant by design; exclude them explicitly, do not just approve

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IFnk4U8Lbp8qg4wXmkLU6w