The Ghost Account Problem: What Dormant Licences Are Costing You

A former employee leaves. A contractor finishes a project. A software trial ends. The work moves on, but the accounts may stay behind.

These overlooked logins, often called ghost accounts, can quietly drain your software budget and leave access open after it is no longer needed. They may be regular user accounts, privileged admin accounts, or service accounts tied to an old process.

The fix is not to delete every account that looks quiet. It is to identify who or what uses each account, confirm the business need, and clean up access in a controlled, documented way. Make that review part of your quarterly IT routine, not a one-time spring clean.

What Counts as a Ghost Account?

A ghost account is an account that remains active or licensed without a clear, current owner or business purpose. Common examples include:

• Former employees: Their account or app access was not fully disabled when they left.
• Departed contractors: A project ends, but the vendor login, VPN access, or SaaS account remains.
• Unowned shared accounts: Multiple people know the password, but no one is accountable for its use.
• Expired trials: A test account or subscription continues after the pilot is over.
• Stale service accounts: An automation or integration still has credentials, but its owner, purpose, or dependencies are unclear.

One person may have accounts in Microsoft 365, a CRM, project-management software, file storage, a design platform, and other business tools. Disabling a network login alone does not necessarily remove every app assignment, active session, or access token.

The Money Adds Up Quietly

A licence can remain on an invoice long after its user has left. That recurring charge does not cause an alert; it simply rolls into the next billing cycle.

The amount depends on your contracts and product mix, so do not rely on a generic industry price estimate. Run your own numbers using current invoices or subscription records.

Product or service	Dormant seats	Monthly price per seat from your invoice	Annual cost to review
Microsoft 365	Your count	Your rate	Seats × monthly rate × 12
CRM	Your count	Your rate	Seats × monthly rate × 12
Project or design software	Your count	Your rate	Seats × monthly rate × 12
Other SaaS tools	Your count	Your rate	Seats × monthly rate × 12

For a practical illustration, if your review finds 10–15 unused seats, calculate each product separately: dormant seats × that product’s actual monthly per-seat cost × 12. Then add the annual amounts across tools. If a dormant person still has licences in several systems, count each one. That is how a small-looking seat count can turn into a meaningful yearly expense.

Use the IT Downtime Cost Calculator (link coming soon) to estimate the separate cost of operational interruptions. It does not replace a licence audit, but it can help you compare subscription waste with the business impact of disruption.

The Security Exposure Is More Than an Old Login

A valid account with stale credentials can give an attacker a way in without needing to exploit a software vulnerability. A ghost account may have missed your normal onboarding and offboarding checks, may not be covered by your current MFA policy, or may retain permissions the person no longer needs.

That matters because attackers can try stolen username-and-password combinations through credential stuffing. If an account works, they may use its access to explore connected systems or pursue lateral movement, moving from one account or resource to another.

Privileged accounts, vendor logins, and accounts with access to email, file stores, finance systems, or remote access deserve particular attention. Shared accounts complicate the picture: when several people use one login, it is harder to establish who accessed what or to remove access for just one person.

Service accounts need a different kind of review. They may authenticate through an application or scheduled job rather than a human sign-in, so a missing interactive sign-in does not prove the account is unused. Confirm the workload, owner, permissions, and credentials before making a change.

Connect Access Reviews to Cyber Insurance Readiness

Cyber insurance applications and renewals may ask how your business controls access, reviews accounts, uses MFA, and handles departing employees. Requirements vary by insurer and policy, so confirm the details with your broker or underwriter.

A repeatable access-review process gives you more than a policy statement. It creates evidence of what you checked, what you changed, who approved exceptions, and when the work happened. Keep review exports, approvals, change records, and relevant offboarding documentation together.

Audit Accounts in a Controlled Order

Treat a 90-day no-sign-in flag as a candidate for review, not an automatic deletion rule. Microsoft’s guidance includes inactive-account reporting and configurable thresholds; the right period depends on the account type, your work patterns, and the data available. Microsoft Entra’s inactive-account guidance is a useful reference. CIS also recommends maintaining and reviewing account inventories in its Account Management safeguards.

Use this sequence:

1. Pull the account lists. Export user and licence information from Microsoft 365/Entra ID and your other key applications. Include guests, VPN accounts, local or cloud admin accounts, and known service accounts where possible.
2. Cross-check with HR and active staff. Confirm whether each person is an employee, current contractor, or approved partner. Check recent leavers and role changes against the access list.
3. Review activity and usage. Flag human accounts with no sign-in in 90 or more days, then verify with the account owner. Check licence assignment against actual application usage where that data is available.
4. Check elevated, shared, and non-human accounts. Confirm every admin or privileged role has a current business need. Give each shared or service account a named owner, documented purpose, and review date.
5. Approve and record the action. Choose whether to retain, reduce permissions, disable, convert, or remove each account. Document the decision, approver, date, and any exception.

Disable or Remove Access Without Breaking Work

Do not treat a cleanup spreadsheet as permission to disable accounts in bulk. An account may own business data, support a scheduled job, or be connected to a system that no one has documented yet.

For each confirmed leaver or unused account, follow your organization’s change process. Disable access, revoke sessions or tokens where appropriate, remove application assignments and privileged roles, and preserve records according to your retention requirements. For service accounts, verify dependencies and arrange credential rotation or replacement before making changes that could interrupt a process.

If an account has no clear owner, pause and investigate. Assign an accountable owner or document why the account must remain. Avoid keeping an exception open indefinitely: record who approved it, why it is needed, and when it must be reviewed again.

When auditing software accounts, also look for accounts created for unapproved AI tools. The Shadow AI Risk Self-Assessment can help frame that review (link coming soon).

Make It a Quarterly Rhythm

A quarterly review turns account cleanup into routine maintenance. Put it on the calendar, assign owners across IT, HR, and application teams, and track outstanding decisions until they are resolved.

A reliable cycle should leave you with:

• An account list tied to a person or system owner.
• A clear view of assigned licences and usage.
• A documented review of privileged, shared, and service accounts.
• A record of disabled access, removed licences, and approved exceptions.
• Follow-up actions with owners and due dates.

That is practical IT cost-saving and a reduction in avoidable business IT risks, without guessing at software prices or shutting down an account that supports real work.

Find the Guide. Get the Review Done.

The Ghost Account Audit Guide is available through the PWP SYSTEMS member portal. Existing clients can also use the Customer Portal to access support and client resources. If you need help turning account exports into a controlled review, our managed IT services provide a path to technical support.

Be faster. Reduce waste. Close stale access. Make the next account review a scheduled task, not a reaction to an incident.

---

Companion Cheat Sheet for Sonny

Five-Step Summary

1. Export account and licence lists from Microsoft 365 and your other business applications.
2. Cross-check against HR and current staff to spot former employees, contractors, and unowned accounts.
3. Flag inactive human accounts. 90+ days is a review starting point, not an automatic deletion rule.
4. Verify privileged, shared, and service accounts with an owner before changing access.
5. Disable, remove, or document exceptions through a controlled process, then repeat the review quarterly.

Social Caption

Dormant accounts can cost you twice: unused software seats keep billing, and stale access can leave a door open. Start with your account and licence lists, verify owners and usage, then document every change. Make it a quarterly habit, not a one-off cleanup.

Get the Ghost Account Audit Guide in the PWP SYSTEMS member portal: https://pwpsystems.com/support-portal

Suggested Carousel

1. The Ghost Account Problem: unused accounts can create both cost and security exposure.
2. What to Look For. Former employees, departed contractors, shared logins, expired trials, stale service accounts.
3. Count the Cost: seats × your actual monthly price × 12; calculate each product separately.
4. Audit Before You Disable: cross-check HR, sign-ins, usage, admin roles, and account owners.
5. Repeat Quarterly: document decisions, remove unnecessary access, and review exceptions.

Visual Direction

Use a dark navy and blue enterprise-security palette with restrained red accents. Keep graphics simple and practical: an inactive user icon, subscription-seat tiles, a magnifying glass over an activity timeline, and a checklist. Avoid dramatic hacker imagery. End the carousel with a clear portal CTA for the Ghost Account Audit Guide.