Find disabled and deleted users with lingering SharePoint permissions for cleanup.
Related topics
orphaned users
stale permissions
user cleanup
access review
security hygiene
About this tool
The Orphaned Users Report identifies disabled or deleted users who still have SharePoint permissions. These lingering access grants pose security risks and compliance issues.
Scan all SharePoint sites for permissions assigned to users who no longer exist in Azure AD or have been disabled. Generate reports with direct links to remove the orphaned permissions.
Essential for maintaining least-privilege access and cleaning up after employee departures.
Key features
Disabled user detection
Deleted user identification
Site-by-site analysis
Permission level detail
Remediation guidance
Bulk cleanup support
Compliance documentation
Scheduled scanning
Use cases
Access hygiene. Remove permissions for departed employees
Requires a paid edition (security). The Suite bundle includes this tool alongside every other capability in the catalogue.
Limitations & out-of-scope
Directory.Read.All lets the tool cross-reference SharePoint permission holders against Entra ID's user status, but it only checks SharePoint access — a disabled account that still has an Exchange mailbox delegate or a Teams ownership role won't surface here. Detected orphaned permissions aren't removed automatically; that remains a manual cleanup step in SharePoint admin center or PowerShell.