Find Disabled Users in Microsoft 365 (Office 365)

This guide shows you how to locate disabled (blocked sign-in) user accounts in Microsoft 365 (Office 365). You’ll learn several methods—using the admin center, PowerShell, and the Entra admin center—so you can audit accounts, clean up licensing, or reactivate users as needed. No prior PowerShell experience is required, but you’ll need appropriate admin permissions.

What You’ll Need

• Global Administrator or User Administrator role in Microsoft 365.
• Access to the Microsoft 365 admin center (admin.microsoft.com).
• For PowerShell method: the Microsoft Graph PowerShell SDK installed (instructions provided).

Step-by-Step

Method 1: Using the Microsoft 365 Admin Center

1. Go to admin.microsoft.com and sign in with your admin account.
2. In the left navigation, expand Users and select Active users.
3. Click the Filters icon (funnel symbol) at the top of the user list.
4. In the filter panel, choose Sign-in status and then select Blocked from the dropdown.
5. Click Apply. The list now shows only users whose sign-in is blocked—these are your disabled accounts.
6. To see details or re-enable a user, click on their name, then select the Account tab. Under Sign-in status, toggle the switch to Enabled and click Save.

Method 2: Using Microsoft Graph PowerShell (Recommended for Bulk)

1. Open PowerShell as an administrator.
2. Install the Microsoft Graph SDK if not already installed:

   Install-Module Microsoft.Graph -Scope CurrentUser

3. Connect to Microsoft Graph with the required scopes:

   Connect-MgGraph -Scopes "User.Read.All"

4. Retrieve all users where accountEnabled is $false:

   Get-MgUser -All -Filter "accountEnabled eq false" | Select-Object DisplayName, UserPrincipalName, Id

5. To export the list to a CSV file:

   Get-MgUser -All -Filter "accountEnabled eq false" | Select-Object DisplayName, UserPrincipalName, Id | Export-Csv -Path "disabled-users.csv" -NoTypeInformation

Method 3: Using the Microsoft Entra Admin Center

1. Go to entra.microsoft.com and sign in.
2. Under Identity, select Users > All users.
3. Click the Add filter button at the top of the list.
4. Choose Account enabled as the filter field, set the value to No, and click Apply.
5. The list now shows all disabled users. You can click each user to view details or re-enable them.

Common Mistakes

• Confusing “disabled” with “deleted” or “unlicensed.” A disabled user still exists but cannot sign in. Deleted users are removed from the directory, and unlicensed users may still sign in if they have a free license.
• Using the wrong filter. In the admin center, the filter is called “Sign-in status,” not “Account status.” In Entra, it’s “Account enabled.”
• Forgetting to include all users in PowerShell. The -All parameter is essential; without it, you only get the first 100 results.
• Not having the right permissions. If you’re only a Helpdesk Administrator, you may not see the sign-in status. Use an account with at least User Administrator.

Tips

• Use the PowerShell method when you need a list for reporting or bulk actions—it’s faster and more reliable for large directories.
• Before re-enabling a user, check their license assignment. If they were disabled due to non-payment, you may need to assign a license again.
• Regularly audit disabled accounts to ensure they are truly inactive. If an account has been disabled for more than 90 days, consider deleting it to reduce security risks.
• If you’re using the admin center, save the filter as a view for quick access later.

Troubleshooting

• Filter shows no results. This usually means there are no disabled users. Try removing the filter to confirm the list is populated.
• PowerShell returns an error about permissions. Ensure you have the User.Read.All scope. You can re-connect with Connect-MgGraph -Scopes "User.Read.All" -Force.
• PowerShell command not recognized. The Microsoft Graph module may not be installed. Run Install-Module Microsoft.Graph and then try again.
• You can’t see the “Sign-in status” column. Click the “Choose columns” button and add it to your view.
• User shows as enabled but still can’t sign in. Check if the user’s password is expired or if they are blocked by a conditional access policy. Also verify the user is not disabled in the on-premises Active Directory if you use hybrid identity.

Frequently Asked Questions

What does “disabled” mean in Microsoft 365?

A disabled user account has the accountEnabled property set to false. This prevents the user from signing in to any Microsoft 365 services, but their data (mailbox, files, etc.) remains intact.

Can I find disabled users without PowerShell?

Yes, you can use the Microsoft 365 admin center or the Entra admin center as described above. Both provide a graphical interface to filter for disabled accounts.

How do I re-enable a disabled user?

In the admin center, go to the user’s profile, click the Account tab, and toggle the sign-in status to Enabled. In PowerShell, use Update-MgUser -UserId "user@domain.com" -AccountEnabled $true.

Will disabling a user delete their mailbox or files?

No, disabling only blocks sign-in. Their mailbox, OneDrive, and other data are preserved. You can re-enable the account later without data loss.

Can I export the list of disabled users to a file?

Yes, using PowerShell you can pipe the results to Export-Csv. In the admin center, you can copy the list or use the “Export users” feature (though it exports all users, then you can filter in Excel).

Why would a user be disabled automatically?

Administrators may disable accounts manually, or the system may disable accounts after repeated sign-in failures or due to security policies. Also, if a user is removed from an on-premises AD sync, the cloud account might be disabled.

Related

• WhatsApp to Telegram Chat Transfer Guide
• Secure Localized Password Reset Email: 6 Controls
• How to Save Emails to a Local Hard Drive