Dormancy-Aware Risk Prioritization: Disabled Accounts and Dormant Edges

Overview

A disabled account can't authenticate, so none of its access can be used until someone enables it again. GraphnAI treats account state as its own dimension of priority, alongside risk:

Active identities sort above disabled identities of equal risk in the main identity lists, so you work on usable access first.
Disabled identities carry a crossed-out icon wherever they appear: tables, flyouts, graphs and search.
The Disabled filter in the Identity Inventory lists only disabled accounts, for targeted cleanup.
Disabled accounts are never hidden. A disabled privileged account is a threat that goes live the moment it's enabled again.
A dormant edge, which a constraint currently blocks, costs more on an attack path and ranks last. It's never excluded from counts.
In Select Fire™, disabling an account gets credit for the reach it blocks, so it ranks fairly against narrower removals.

Prerequisites

Role: Operator or Admin.
Data: At least one successful sync from an LDAP bridge or Entra ID. Account state is collected from Active Directory and Entra ID during the sync, and risk scores come from the analytics that run after it.

Disabled Accounts

What counts as disabled

An identity is disabled when its account is explicitly disabled: the ACCOUNTDISABLE flag of userAccountControl in Active Directory, or accountEnabled set to false in Entra ID. Only an explicitly disabled account counts. When the state is unknown or doesn't apply, as for a group, GraphnAI treats the identity as active, so it never hides a risky account.

The Risk Score doesn't change

A disabled account keeps its full Risk Score. The number is how dangerous the account would be if someone enabled it again. A disabled Domain Admin with a score of 80 still shows 80, because enabling it would bring back all of that risk.

What changes is where the account sorts. Disabled accounts sink below active accounts, so the risk you can act on today comes first.

Disabled isn't the same as stale

The two are separate:

State	What it means	Example
Stale	No activity for longer than its type's threshold	A user account unused for 120 days
Disabled	Explicitly disabled	A privileged account disabled yesterday

A recently disabled account is disabled but not stale. An enabled account that's been inactive a long time is stale but not disabled. An account can be both. That's why the Identity Inventory has separate Stale and Disabled filters.

How Disabled Accounts Appear

Crossed-out icon in tables and flyouts

A disabled account's type icon carries a crossed-out overlay (a circle with a slash). Hover it to read "Account disabled. Paths through it stay closed until it's enabled again." It looks the same in every table and in an identity's flyout header, wherever you open it: a table row, the graph or Select Fire™.

Dimmed nodes in graph views

In the graphs, a disabled account has the same crossed-out overlay, is dimmed and has a dashed border. It's never removed. A disabled account is often a step in a blast radius or an attack path, and hiding it would hide the path. The graph legend lists the treatment as Disabled.

In the legend, Dormant (blocked by a constraint) means something else: an edge that exists but that a constraint currently blocks. See Dormant Edges.

Search results

The top-bar search and the identity picker in Select Fire™ show a Disabled badge on disabled accounts. You can still choose a disabled account as the subject of an investigation or a remediation.

Sorting Behavior

Active accounts always sort first

Account state is the first sort key, before any column you choose. Active identities form the top band, and disabled identities the bottom band. Within each band, rows sort by the column you choose: Risk Score, highest first, by default.

This can't be turned off. Within the disabled band, the riskiest disabled account comes first.

For example, with 50 active accounts and 10 disabled ones, all 10 disabled accounts appear below all 50 active ones. A disabled account scoring 95 never appears above an active account scoring 40.

Where it applies

Identity Inventory, with any filter
Risk Posture Dashboard, Top findings
Critical Junctions
The tables in the Graph Explorer, including the drill-down tables for grouped nodes

CSV and JSON exports

Exports from the Identity Inventory include an Account enabled column for every row. Disabled accounts are never left out of an export. Use the column to filter or highlight them in your reports.

Dormant Edges: Costlier, Ranked Last, Never Excluded

A dormant edge exists, but a constraint currently blocks it. The graph legend lists it as Dormant (blocked by a constraint), and the edge panel marks it Dormant. Two kinds of constraint make an edge dormant today:

A disabled source account. When telemetry sees the account disabled (event 4725), its logon sessions turn dormant too.
A PIM role that's eligible but not activated.

A dormant edge is a valid attack path that costs more, not a path that doesn't exist. Someone can often lift the block, for example by re-enabling the account. GraphnAI handles it two ways:

Attack paths price it higher. Each dormant edge adds an activation cost to its path. A route made of active edges outranks a dormant route of similar length, and a longer active route can outrank a shorter dormant one. A path that can only run through a dormant edge is still returned, with an Activation required badge that names the account to activate.
Counts include it. Reach percentages, blast radius, Critical Junctions and the peer statistics behind Over-Permission Analytics (mean, standard deviation and outliers) all count dormant edges as latent reach. Dormancy changes the order and the label, never the total.

When the block lifts, for example when the account is enabled again, the edge costs what an active edge costs.

The Disabled Filter

The Disabled filter lists only disabled accounts. Use it to review accounts that are disabled but still hold dangerous group memberships, Tier 0 access or heavy permission loads.

Select Identity Inventory in the sidebar.
Select Filters.
Under Hygiene and lifecycle, select Disabled. The count beside it shows how many disabled accounts the current tab holds.
To return to the full list, select the × on the Disabled chip.

One filter applies at a time.

Select Fire™: Credit for Disabling an Account

How the projection works

In Select Fire™, the plan can include disabling the account as an account-wide action. Its projected risk reduction credits the reach the disable blocks, as well as the staleness it resets.

A disabled account can't authenticate, so none of its remaining permissions can be used. The access still exists on paper, and enabling the account would bring it back. GraphnAI counts that remaining access at half its weight, the weight of Constrained evidence.

The reduction is always partial. A disable is one re-enable away from undone, so it never counts as much as removing the access. The partial credit still lets a containment rank fairly against narrower removals.

Disabling and removing access in one plan

When a plan both removes access (for example, a dangerous group membership) and disables the account, each gets its own credit with no double counting. The removed access comes off first. The disable's discount then applies only to the access that's left.

An account that's already disabled

If you open Select Fire™ for an account that's already disabled, the subject card shows a Disabled badge. Disabling it again changes nothing. Consider removing the risky access instead, such as the dangerous group membership or permission, so enabling the account later doesn't bring the threat back. Select Fire can simulate and run those removals.

Not Yet Available

Confidence rating: disabling an account can raise its Confidence rating when most of its evidence is Theoretical. The active-first sort already stops this from reordering lists. A fix to the rating itself is planned.
Automatic cleanup of disabled accounts: automatically removing risky access from accounts that are disabled and long inactive is planned. It isn't available yet.
Entra ID: the disable credit applies to Active Directory accounts. The same credit for Entra ID accounts is planned.

Troubleshooting

A disabled account sorts above active accounts

The sort needs the account state on the identity's row, which comes from the sync and the analytics after it. If a sync hasn't completed, or the analytics haven't run since, some rows may have no state yet and sort as active. Run a sync, and confirm the analytics finished.

The Disabled filter shows no results, but disabled accounts exist

The filter needs the account state from a sync. If the last sync didn't complete, the filter stays empty until the next one finishes. Check the domain's sync status under Admin > Bridges and confirm a recent successful sync.

The crossed-out icon is missing on a disabled account

The icon needs the account state, which the sync collects. A newly disabled account shows the icon after the next sync picks up the change. Delta syncs collect state changes, so you don't need a full sync. If the icon is still missing after a sync, confirm the account is disabled in the directory and check the sync for collection errors on that object.

Select Fire™ shows a small reduction for disabling an account

The credit for a disable is partial by design, because enabling the account would restore its access. If the reduction looks small, the identity's risk may come mostly from factors a disable doesn't block, such as group hygiene. For a bigger reduction, combine the disable with removing the risky group memberships or direct permissions in the same plan.

An attack path runs through a disabled account

This is expected. A dormant edge is a path that costs more, not a path that doesn't exist. The path is returned with an Activation required badge and the name of the account to activate. A route made of active edges ranks above it.

A disabled account appears in the graph

Disabled accounts are never hidden from graphs. A disabled account often sits in the middle of a blast radius or an attack path, and removing it would hide the path. The crossed-out overlay and dimming show its state instead.