Dormancy-Aware Risk Prioritization
Disabled accounts sort below active accounts of equal risk, so you work on what can be used today first. They stay visible everywhere, because a disabled privileged account is one re-enable away from being live.
Requires role: Operator or Admin Related: Identity Inventory, Risk Posture Dashboard, Select Fire™, Stale Identity Detection
Overview
A disabled account can't sign in, so none of its access can be used until someone enables it again. GraphnAI treats account state as its own dimension of priority, alongside risk:
- Active identities sort above disabled identities of equal risk in the main identity lists, so you work on usable access first.
- Disabled identities carry a crossed-out icon wherever they appear: tables, flyouts, graphs and search.
- The Disabled filter in the Identity Inventory lists only disabled accounts, for targeted cleanup.
- Disabled accounts are never hidden. A disabled privileged account is a threat that goes live the moment it's enabled again.
- In Select Fire™, disabling an account gets credit for the reach it blocks, so it ranks fairly against narrower removals.
Prerequisites
- Role: Operator or Admin.
- Data: At least one successful sync from an LDAP bridge or Entra ID. Account state is collected from Active Directory and Entra ID during the sync, and risk scores come from the analytics that run after it.
Disabled Accounts
What counts as disabled
An identity is disabled when its account is explicitly disabled: the disabled flag in Active Directory, or the account-enabled setting in Entra ID. Only an explicitly disabled account counts. When the state is unknown or doesn't apply, as for a group, GraphnAI treats the identity as active, so it never hides a risky account.
The Risk Score doesn't change
A disabled account keeps its full Risk Score. The number is how dangerous the account would be if someone enabled it again. A disabled Domain Admin with a score of 80 still shows 80, because enabling it would bring back all of that risk.
What changes is where the account sorts. Disabled accounts sink below active accounts, so the risk you can act on today comes first.
Disabled isn't the same as stale
The two are separate:
| State | What it means | Example |
|---|---|---|
| Stale | No activity for longer than its type's threshold | A user account unused for 120 days |
| Disabled | Explicitly disabled | A privileged account disabled yesterday |
A recently disabled account is disabled but not stale. An enabled account that's been inactive a long time is stale but not disabled. An account can be both. That's why the Identity Inventory has separate Stale and Disabled filters.
How Disabled Accounts Appear
Crossed-out icon in tables and flyouts
A disabled account's type icon carries a crossed-out overlay (a circle with a slash). Hover it to read "Account disabled. Paths through it stay closed until it's enabled again." It looks the same in every table and in an identity's flyout header, wherever you open it: a table row, the graph or Select Fire™.
Dimmed nodes in graph views
In the graphs, a disabled account has the same crossed-out overlay, is dimmed and has a dashed border. It's never removed. A disabled account is often a step in a blast radius or an attack path, and hiding it would hide the path. The graph legend lists the treatment as Disabled.
In the legend, Dormant (blocked by a constraint) means something else: a relationship that exists but that a constraint currently blocks.
Search results
The top-bar search and the identity picker in Select Fire™ show a Disabled badge on disabled accounts. You can still choose a disabled account as the subject of an investigation or a remediation.
Sorting Behavior
Active accounts always sort first
Account state is the first sort key, before any column you choose. Active identities form the top band, and disabled identities the bottom band. Within each band, rows sort by the column you choose: Risk Score, highest first, by default.
This can't be turned off. Within the disabled band, the riskiest disabled account comes first.
For example, with 50 active accounts and 10 disabled ones, all 10 disabled accounts appear below all 50 active ones. A disabled account scoring 95 never appears above an active account scoring 40.
Where it applies
- Identity Inventory, with any filter
- Risk Posture Dashboard, Top findings
- Critical Junctions
- The tables in the Graph Explorer, including the drill-down tables for grouped nodes
CSV and JSON exports
Exports from the Identity Inventory include an Account enabled column for every row. Disabled accounts are never left out of an export. Use the column to filter or highlight them in your reports.
The Disabled Filter
The Disabled filter lists only disabled accounts. Use it to review accounts that are disabled but still hold dangerous group memberships, Tier 0 access or heavy permission loads.
- Select Identity Inventory in the sidebar.
- Select Filters.
- Under Hygiene and lifecycle, select Disabled. The count beside it shows how many disabled accounts the current tab holds.
- To return to the full list, select the × on the Disabled chip.
One filter applies at a time.
Select Fire™: Credit for Disabling an Account
How the projection works
In Select Fire™, the plan can include disabling the account as an account-wide action. Its projected risk reduction credits the reach the disable blocks, as well as the staleness it resets.
A disabled account can't sign in, so none of its remaining permissions can be used. The access still exists on paper, and enabling the account would bring it back. GraphnAI counts that remaining access at half its weight, the weight of Constrained evidence.
The reduction is always partial. A disable is one re-enable away from undone, so it never counts as much as removing the access. The partial credit still lets a containment rank fairly against narrower removals.
Disabling and removing access in one plan
When a plan both removes access (for example, a dangerous group membership) and disables the account, each gets its own credit with no double counting. The removed access comes off first. The disable's discount then applies only to the access that's left.
An account that's already disabled
If you open Select Fire™ for an account that's already disabled, the subject card shows a Disabled badge. Disabling it again changes nothing. Consider removing the risky access instead, such as the dangerous group membership or permission, so enabling the account later doesn't bring the threat back. Select Fire can simulate and run those removals.
Not Yet Available
- Confidence rating: disabling an account can raise its Confidence rating when most of its evidence is Theoretical. The active-first sort already stops this from reordering lists. A fix to the rating itself is planned.
- Automatic cleanup of disabled accounts: automatically removing risky access from accounts that are disabled and long inactive is planned. It isn't available yet.
- Entra ID: the disable credit applies to Active Directory accounts. The same credit for Entra ID accounts is planned.
Troubleshooting
A disabled account sorts above active accounts
The sort needs the account state on the identity's row, which comes from the sync and the analytics after it. If a sync hasn't completed, or the analytics haven't run since, some rows may have no state yet and sort as active. Run a sync, and confirm the analytics finished.
The Disabled filter shows no results, but disabled accounts exist
The filter needs the account state from a sync. If the last sync didn't complete, the filter stays empty until the next one finishes. Check the domain's sync status under Admin > Bridges and confirm a recent successful sync.
The crossed-out icon is missing on a disabled account
The icon needs the account state, which the sync collects. A newly disabled account shows the icon after the next sync picks up the change. Delta syncs collect state changes, so you don't need a full sync. If the icon is still missing after a sync, confirm the account is disabled in the directory and check the sync for collection errors on that object.
Select Fire™ shows a small reduction for disabling an account
The credit for a disable is partial by design, because enabling the account would restore its access. If the reduction looks small, the identity's risk may come mostly from factors a disable doesn't block, such as group hygiene. For a bigger reduction, combine the disable with removing the risky group memberships or direct permissions in the same plan.
A disabled account appears in the graph
Disabled accounts are never hidden from graphs. A disabled account often sits in the middle of a blast radius or an attack path, and removing it would hide the path. The crossed-out overlay and dimming show its state instead.