# US 11,907,367 B2 · Dormant account identifier > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,367 B2 - Document ID: US11907367B2 - Status: Granted - Kind: B2 - Application number: 16/692,545 - Filed: 2019-11-22 - Published: 2021-05-27 - Granted: 2024-02-20 - Earliest claimed: 2019-11-22 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Itay Argoety; Tomer Haimovich; Amir Harar - Web page: https://patentgrep.com/patent/US11907367B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/554: {involving event detection and direct action} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A dormant account identifier is disclosed. An inactive account can be determined based on whether a user activity of the account is outside a threshold amount. A determination can be made as to whether the inactive account is a dormant account based on account activity of a peer account to the inactive account. ## Claims ### Claim 1 A method, comprising: determining that an account of a user of an enterprise is an inactive account based on user account activity of the account being outside a threshold amount; determining a peer of the user based on at least one of the following: the user and the peer of the user working in a same department of the enterprise; the user and the peer of the user collaborating in a web-application resource of the enterprise via the user account and a peer account of the peer of the user; and determining whether the inactive account of the user is a dormant account based on peer account activity of the peer account of the peer of the user. ### Claim 2 (depends on 1) The method of claim 1 wherein determining the inactive account includes receiving account activity information from a plurality of accounts. ### Claim 3 (depends on 1) The method of claim 1 wherein determining the inactive account includes tracking account activity of a plurality of accounts. ### Claim 4 (depends on 1) The method of claim 1 wherein the account activity outside a threshold amount includes a date of last use that exceeds the threshold amount. ### Claim 5 (depends on 1) The method of claim 1 wherein the date of last use includes a date of a last successful login session. ### Claim 6 (depends on 1) The method of claim 1 wherein an account having a date of last use that does not exceed the threshold amount is an active account. ### Claim 7 (depends on 1) The method of claim 1 wherein the account activity of the peer account includes a frequency of use of the peer account. ### Claim 8 (depends on 1) The method of claim 1 wherein the account activity of the peer account includes a date of last use of the peer account. ### Claim 9 (depends on 1) The method of claim 1 comprising: deprovisioning the dormant account. ### Claim 10 (depends on 1) The method of claim 1 wherein the determining whether the inactive account is a dormant account is based on peer account activity of a plurality of peer accounts of a plurality of peers of the user in the enterprise with the inactive account of the user. ### Claim 11 A computer readable storage device to store computer executable instructions to control a processor to: determine that an account of a user of an enterprise is an inactive account based on user account activity of the account being outside a threshold amount; determine a peer of the user based on at least one of the following: the user and the peer of the user working in a same department of the enterprise; the user and the peer of the user collaborating in a web-application resource of the enterprise via the user account and a peer account of the peer of the user; and determine whether the inactive account of the user is a dormant account based on peer account activity of the peer account of the peer of the user. ### Claim 12 (depends on 11) The computer readable storage device of claim 11 wherein the user account activity is based on a date of last use of the user account. ### Claim 13 (depends on 12) The computer readable storage device of claim 12 wherein the user account activity is based on whether the date of last use of the user account exceeds the threshold amount. ### Claim 14 (depends on 11) The computer readable storage device of claim 11, the computer executable instructions to control the processor to: receive the user account activity and the account activity of the peer account. ### Claim 15 (depends on 11) The computer readable storage device of claim 11, the computer executable instructions to control the processor to: determine a plurality of peer accounts to the inactive accounts. ### Claim 16 (depends on 15) The computer readable storage device of claim 15 wherein the plurality of peer accounts are based on an organizational structure of an enterprise. ### Claim 17 A system, comprising: a memory device to store a set of instructions; and a processor to execute the set of instructions to: determine that an account of a user of an enterprise is an inactive account based on user account activity of the account being outside a threshold amount; determine a peer of the user based on at least one of the following: the user and the peer of the user working in a same department of the enterprise; the user and the peer of the user collaborating in a web-application resource of the enterprise via the user account and a peer account of the peer of the user; and determine whether the inactive account of the user is a dormant account based on peer account activity of the peer account of the peer of the user. ### Claim 18 (depends on 17) The system of claim 17 wherein the instructions are implemented with a security service of a cloud environment. ### Claim 19 (depends on 17) The system of claim 17 wherein the threshold amount includes one of a selected amount of time or a frequency of use. ### Claim 20 (depends on 17) The system of claim 17 comprising instructions to deprovision the dormant account.