Account Security Problems

How to Delete Inactive Users from Azure AD and On-Premises Active Directory

Bushra Parveen Oct 15, 2026 870 views

Question details

The administrator needs to manage and delete inactive users, revoked licenses, duplicate accounts, contractors, and guest accounts that are synchronized between Azure AD and On-Premises AD.

How to Delete Inactive Users from Azure AD and On-Premises Active Directory

Product: Azure Active Directory and On-Premises AD
Device & OS: not provided
Scenario: Cleaning up the directory environment by identifying and deleting inactive accounts while maintaining identity governance.
Observed behavior: The administrator requires a controlled process to correctly identify inactive users, handle exceptions, and delete or disable the accounts in the correct source directory before synchronization.

Before you start

Before deleting any synchronized accounts, ensure you are removing them from the correct source directory (On-Premises AD) rather than directly in Azure AD, as changes must synchronize to the cloud properly.

Solution 1Recommended

Implement a Controlled Identity Governance Process

Use a structured directory-management approach to identify, verify, and safely remove inactive or duplicate accounts from your Active Directory environment.

Synchronized accounts are managed on-premises, meaning any deletion or disabling must occur in your local source Active Directory. These changes will subsequently sync to Azure AD automatically.

It is crucial to filter out legitimate exceptions such as active contractors, guest accounts with ongoing collaborations, and vital service accounts during your cleanup process.

Identify inactive accounts

Run identity governance queries or PowerShell scripts against your directory to find users who have not logged in for an extended period and review their UPN and SMTP addresses.

Review and exclude exceptions

Manually or automatically filter out valid exceptions such as active contractors, long-term leave employees, and service accounts before proceeding with deletion.

Delete or disable in the source directory

Open your On-Premises Active Directory Users and Computers (ADUC) console, locate the verified inactive account, right-click it, and select 'Disable Account' or 'Delete'.

Wait for directory synchronization

Allow Azure AD Connect to run its scheduled sync cycle. This will push the deleted or disabled account status up to Azure AD, effectively removing the user's access.

Implement a Controlled Identity Governance Process

Microsoft Q&A Forum Support: For highly complex synchronization scenarios or detailed implementation scripts, Microsoft recommends posting your specific environment details on the Microsoft Q&A forum for expert assistance.

Free Microsoft Office alternative

Manage Your IT Documentation with WPS Office

While managing complex environments like Azure AD requires native administrative tools, drafting your IT governance policies, synchronization scripts, and user lists doesn't need an expensive productivity suite. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office.

1. Download WPS Office: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the software: Run the installer and follow the on-screen instructions to set up WPS Office on your workstation.
3. Document your IT policies: Open WPS Writer or WPS Spreadsheet to start creating your identity governance guidelines and inactive user tracking lists.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Easily document Active Directory cleanup procedures and user governance policies.Lightweight installation and low system resource consumption.Free to use with a familiar interface, ensuring seamless migration for your IT team.

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I delete a synchronized user directly in Azure AD?

Synchronized user accounts are mastered in the On-Premises Active Directory. To delete them, you must remove or disable the account in your local Active Directory and let Azure AD Connect sync the changes to the cloud. Azure AD will not allow direct deletion of synced accounts.

How can I identify inactive users before deleting them?

You can use PowerShell scripts or identity governance tools to filter users based on the 'LastLogonTimeStamp' attribute in Active Directory, cross-referencing this with UPN and SMTP addresses to confirm true inactivity.

What happens to a user's revoked licenses when their account is deleted?

When an account is deleted on-premises and the deletion is synchronized to Azure AD, any Office 365 or Azure licenses assigned to that user are automatically revoked and returned to your organization's available license pool.

Microsoft Office Security Issues