how to find orphaned accounts after an acquisition

TL;DR

Export every account from the acquired tenant, cross-check against the current HR roster, and sort into matched, no-HR-record, and duplicate. Disable the orphans first, wait out an objection period, then delete. Disable-before-delete is the rule because an acquisition always hides a few accounts someone still needs.

Steps

1. Export the full user list from the acquired tenant (Okta, Entra, or Google), including last-login date and department. Expected: one row per account, no filters yet.
2. Cross-check against the current HRIS roster. Expected: three buckets: matched to an employee, no HR record, and already disabled but still present.
3. Pull service accounts into a separate list. Expected: every service account has a named owner, or is marked ownerless; service accounts never match HR and must not be auto-deleted.
4. Hunt duplicates: the same person with an account in both tenants. Expected: a pairing list mapping each old account to its new-tenant counterpart.
5. Disable the no-HR-record accounts in one batch and notify their last-known managers with a 30-day objection window. Expected: accounts disabled, mail forwarding set where the business asks for it.
6. After 30 days with no objection, delete the orphans or convert leftovers to shared mailboxes. Expected: a re-run of the export shows zero orphan accounts.

Use this when

• An acquisition closed and tenants are being merged
• A security review asks whose accounts these are
• Users are confused by duplicate logins across tenants

Not for this skill when

• Routine quarterly stale-account reviews (use the standard deprovisioning process)
• The acquired tenant stays separate long-term (run the review, but do not merge)

Compatibility

• Okta, Entra ID, Google Workspace as the acquired tenant
• Any HRIS or payroll export as the roster of truth

Variants

The acquired company has no HRIS

Use payroll records or written manager attestation as the roster. Imperfect beats nothing.

Founders want everything kept

Disable with forwarding and revisit in 90 days. Disabled is safe; deleted is forever.

Why it happens

Acquisitions transfer accounts without transferring the offboarding discipline that maintained them. The new company inherits every ghost the old company forgot to clean up.

Edge cases

• Shared mailboxes misidentified as user accounts: check the mailbox type before disabling.
• Legal-hold accounts that must not be deleted: mark them hold, disable sign-in, document why.
• Acquired employees rehired later: reactivation from a disabled account beats recreating one.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Q0KyQaROp82LzoBQ7AGDJA