Dormant privilege

Dormant privilege is access that has been granted and never, or not recently, used. A common threshold is 60 or 90 days. It accumulates naturally: people change roles and keep old entitlements, project access outlives the project, break-glass accounts are created and forgotten.

Dormant privileged grants — admin, owner, write on sensitive systems — are the highest-value clean-up in most environments. They provide the business nothing and provide an attacker who compromises the account a ready-made path. Finding them requires knowing what is used, not only what is granted, which is why dormancy is a product of comparing identity-provider data with observed authentication rather than something a directory can report on its own.