Inactivity Sweep

What it does

Finds the active accounts nobody has signed into for a long time, and the groups with no active members left — and for every one of them, counts what still depends on it.

Then you decide. It cannot deactivate a user, empty a group or remove a role — it has no way to.

The reference count is the product

Anybody can write the query that lists accounts with no sign-in in ninety days. Most instances have had that list produced at least once.

The reason it never gets acted on is that nobody knows which entries are load bearing. Deactivate the wrong one and an approval chain stalls, a scheduled job stops running, or somebody's manager field goes empty in the middle of a review cycle. So the list gets filed, and the accounts stay active for another year.

This counts, for each dormant thing it finds:

Open tasks assigned - Deactivating reassigns nothing; the work simply stops Approvals waiting on them - An approval nobody can action holds up a request indefinitely People reporting to them - An empty manager field breaks reviews and escalations Scheduled jobs running as them - The job fails quietly at 2am, weeks later Groups they manage - The group loses its owner and nobody notices until it matters Delegations - Somebody is still acting on their behalf

Zero means it can be retired on the evidence in front of you. Anything else means read first. That is the whole distinction, and it is the one nobody has time to work out by hand for four hundred accounts.

What it looks for

Dormant user - An active account with no sign-in inside the threshold, or none ever. Never-signed-in counts — an account created two years ago and never used is the clearest case there is, and reading "never" as "no data, skip it" is how those survive every audit. Empty group - A group with no active members. Either it never had any, which is somebody's abandoned experiment, or every member has left, which is a rota that quietly stopped.

Why ninety days

It is a quarter, and it is the default because shorter thresholds name people who are on parental leave, a long secondment or extended sick leave. The first time a cleanup list names somebody who is simply away, people stop trusting the list — and then the genuinely dormant accounts stay active too.

The threshold is a setting. Ninety is where it starts.

What it deliberately does not do

It does not report unused roles. That was in the first version and was removed after measuring it: on a real instance it reported 338, including roles ServiceNow itself ships. Separating a role somebody here created from one a vendor delivered turns out not to be reliably possible, and a list of 338 unactionable items does not sit quietly beside the users and groups — it teaches people the whole report is noise.

Two checks that can be trusted are worth more than three where one is wrong.

What installing it costs you

Nothing to configure and nothing to trust. No credentials, no external service, no outbound network access, no licensed prerequisite. It reads users and groups already on your instance and writes its own findings, which cannot be edited afterwards — somebody deactivates real accounts on the strength of that list.

Two roles: one to run a sweep and read it, one to also delete old sweeps.