Service accounts have been getting disabled after activating it

Question

Service accounts have been getting disabled after activating it

Perkit, Naveen 40

we submitted another request today and received the necessary approvals to re-enable the service accounts. Yesterday, after reactivation, we manually logged into GitHub and https://myapps.microsoft.com using the service accounts. However, the accounts were disabled again today, so we had to raise another request to get them reinstated. While we understand that manual login is required at least once every 90 days to prevent deactivation, we’d like to ensure this doesn't keep recurring. Could you please confirm the recommended AD/SSO-enabled applications or login methods we should be using periodically for these service accounts? The frequent deactivations are impacting our deployments, so any clarity would be helpful.

Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-07T10:02:39.1633333+00:00

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Perkit, Naveen 40 Reputation points

2025-08-07T13:23:54.8366667+00:00

Thanks a lot for your response on this, it looks like our IAG team has to set this attribute AccountExpirationDate to never.
Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-08T13:53:21.61+00:00

Hi @Perkit, Naveen,

Thank you for your response. I have converted the comment into an answer. If you find it helpful, do click Accept Answer and Yes for was this answer helpful. This will help us as well as others in the community who may be researching similar information.
Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-12T07:19:16.83+00:00

Hi @Perkit, Naveen,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Your answer

Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-07T10:02:39.1633333+00:00

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Perkit, Naveen 40 Reputation points

2025-08-07T13:23:54.8366667+00:00

Thanks a lot for your response on this, it looks like our IAG team has to set this attribute AccountExpirationDate to never.
Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-08T13:53:21.61+00:00

Hi @Perkit, Naveen,

Thank you for your response. I have converted the comment into an answer. If you find it helpful, do click Accept Answer and Yes for was this answer helpful. This will help us as well as others in the community who may be researching similar information.
Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-12T07:19:16.83+00:00

Hi @Perkit, Naveen,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Hi Perkit, Naveen,

As per our understanding, you are looking for a way to avoid having the accounts get disabled and wondering if there might be an automated process in Azure that could be causing this behavior.

There isn't an automated process in Azure that would cause the accounts to be disabled, but if users are getting disabled unintentionally, it's possible that someone in your org is running a script to disable the users. Alternatively, there might be a conditional access policy that is blocking the users based on some criteria.

Someone who is using a script to disable the inactive accounts could evaluate the lastSignInDateTime property exposed by the signInActivity resource type of the Microsoft Graph API. Then they could query a list of users whose last lastSignInDateTime is before a specified date and disable those users. This might explain why users are being blocked if they haven't signed in within a three-week timframe.

How to manage inactive user accounts - Microsoft Entra ID | Microsoft Learn

It is also possible that the service accounts are being disabled due to Conditional Access policies. The accounts could get blocked if you have conditional access policies in place that require MFA, block access from certain locations or devices, or determine that the users do not meet certain risk assessments. You can check the sign-in logs and policy settings to determine if users are getting blocked due to Conditional Access settings.

Conditional Access and Microsoft Entra activity logs - Microsoft Entra ID | Microsoft Learn

Let me know if this helps and if you have further questions.

Share via

Service accounts have been getting disabled after activating it

1 answer

Your answer