🎯31 daily security challenges for Cybersecurity Month. Start Playing
Microsoft Entra ID

How to Monitor Users' Sign-in Re-Enabled Activities in Microsoft 365

In Microsoft 365, user accounts are sometimes disabled temporarily during security investigations, compliance reviews, or organizational changes. If re-enabled without proper oversight, these accounts can regain access to emails, files, and other organizational resources, potentially creating security and compliance risks. By monitoring sign-in re-enabled activities, admins can quickly detect and safeguard sensitive data. This guide shows how to track user sign-in re-enabled events in Microsoft 365 and stay informed about such activities.

Microsoft 365 tools
Solution 1
Solution 2
Solution 3
Solution 4
Important Tips
Errors and Resolution Steps
FAQs

Audit User Sign-in Re-Enabled Activities in Microsoft Purview

Microsoft 365 Permission Required
View-Only Audit Logs Role Least Privilege
Global Admin Most Privilege
  • Navigate to the Audit page in the Microsoft Purview portal.
  • Now, customize the Start & End Date and time range as required. Then, enter Enable Account in the ‘Activities - operation names’ field.
  • Click Search. Once the search is complete, select a result to view users’ sign-in re-enablement details.
  • Use the Export option to download the report in CSV format.
Audit User Sign-in Re-Enabled Activities in Microsoft Purview
  • Note: By default, audit logs are retained for 180 days. Retaining audit logs for a longer period requires additional licensing. Extended retention of up to 1 year is available with advanced Microsoft 365 compliance or audit licenses. For 10-year audit log retention, an additional long-term retention add-on is required along with an eligible advanced license.

Identify Re-Enabled Users in Microsoft 365 Using PowerShell

Microsoft 365 Permission Required
View-Only Audit Logs Role Least Privilege
Global Admin Most Privilege
  • Connect to the Exchange Online PowerShell module using the cmdlet below.
  • Windows PowerShell Windows PowerShell 
     Connect-ExchangeOnline
  • Replace <YYYY-MM-DD> with the appropriate start and end dates, then run the following cmdlet to retrieve all activities related to re-enabling user accounts in Microsoft 365.
  • Windows PowerShell Windows PowerShell 
     $AuditData = Search-UnifiedAuditLog -StartDate "YYYY-MM-DD" -EndDate "YYYY-MM-DD" -Operations "Enable Account" 
$AuditData | ForEach-Object {  
    $AuditData = $_.AuditData | ConvertFrom-Json  
    $EnabledUser = $AuditData.Target |  
        Where-Object { $_.Type -eq 5 } |  
        Select-Object -ExpandProperty ID  
    [PSCustomObject]@{  
        EnabledTime = $_.CreationDate  
        EnabledUser = $EnabledUser  
        EnabledBy   = $AuditData.UserId  
        Operation   = $_.Operations  
        RecordType  = $_.RecordType  
    }  
} | Format-Table
  • The executed cmdlet displays all re-enabled events in Microsoft 365, along with details such as enabled time, enabled user, enabled by, operation, and record type.
Identify Re-Enabled Users in Microsoft 365 Using PowerShell

Export Re-Enabled Users Report Using a PowerShell Script

Microsoft 365 Permission Required
View-Only Audit Logs Role Least Privilege
Global Admin Most Privilege
  • The above Search-UnifiedAuditLog cmdlet helps identify all user sign-in reactivation events across your organization. However, it provides limited details only.
  • To overcome this, we have developed a PowerShell script that seamlessly exports user re-enabled activities in Microsoft 365 with additional details.
  • The script is designed to generate activity reports for both re-enabling and disabling events. To generate a report for re-enabling operations, download and run the script using the -EnabledEventsOnly parameter as shown below.
  • Windows PowerShell Windows PowerShell 
     .\AuditUserAccountStatusChanges.ps1 -EnabledEventsOnly
  • The exported CSV file includes detailed information such as event time, user, user type, operation, result status, performed by, and more.
Export Re-Enabled Users Report Using a PowerShell Script
AuditUserAccountStatusChanges.ps1
AdminDroid Entra ID Reporter

Keep Tabs on Re-Enabled M365 Users to Uncover Unseen Security Risks!

AdminDroid's Microsoft Entra ID auditing tool simplifies monitoring user re-enabled events in Microsoft 365 with intuitive and detailed reports. Additionally, tracking re-enabled user sign-ins and associated risky activities helps you proactively identify potential security threats and maintain compliance with ease.

Monitor Re-Enabled User Accounts with Default Alert Policy

Use the re-enabling blocked user accounts default alert policy template to get quick alerts when a disabled user is re-enabled and prevent unauthorized enablement.

Safeguard Organizational Data Before User Re-Enablement

When re-enabling a user, check their past SharePoint file access activities and apply restrictions if sensitive or confidential content was accessed to ensure data security.

Automate Microsoft 365 Re-Enabled Account Reporting

Schedule the sign-in re-enabled users report to receive regular updates via email or Microsoft Teams on a daily, weekly, or monthly basis, and stay informed about all sign-in re-enablement events.

Examine Sign-in Re-enabled Synced Users to Ensure Secure Cloud Access

Leverage AdminDroid’s built-in filter in the synced users report to identify all signed-in enabled users from Active Directory and ensure that only appropriate accounts have access to cloud resources.

Secure Re-Enabled Microsoft 365 User Accounts with MFA Verification

Check MFA status for re-enabled users to strengthen Microsoft 365 account security, enhance account protection, and ensure compliance with robust authentication standards.

Review Mailbox Permissions for Re-Enabled Users in Microsoft 365

Audit and review mailbox permissions of recently re-enabled users to ensure only authorized users retain access, eliminate unnecessary delegations, and avoid data leaks.

Overall, AdminDroid’s Microsoft Entra ID management tool provides a complete, unified solution for streamlining your M365 management tasks. With advanced capabilities such as rich visual dashboards, precise filtering controls, and flexible export options, the management of enabled users becomes significantly simpler and more efficient.

Explore a full range of reporting options
Download Live Demo

Important tips

Use role-based access controls  to limit who can re-enable user sign-ins in Microsoft 365 and reduce the risk of accidental or malicious account activations.

Force a password reset at the next sign-in for all re-enabled user accounts to prevent unauthorized access using old credentials.

In a hybrid setup, re-enable the user account in both the on-premises directory and Microsoft 365 to prevent directory synchronization from disabling it again.

Common Errors and Resolution Steps

The following are possible errors and troubleshooting hints while auditing users whose sign-ins have been re-enabled.

Error Update-MgUser : Insufficient privileges to complete the operation.

This error occurs when the signed-in account or app does not have the necessary Microsoft Graph permissions (such as User.ReadWrite.All) to update user properties like AccountEnabled via PowerShell.

Fix

Ensure the signed-in account has the Global Administrator or User Administrator role in Entra ID. For app registrations or managed identities, ensure the User.ReadWrite.All application permission is granted and admin consent is provided. For delegated (interactive) access, connect to Microsoft Graph with the required scope, as shown below.

Connect-MgGraph -Scopes "User.ReadWrite.All"

Error Set-MgUserLicense : One or more parameters of the operation 'assignLicense' are missing from the request payload. The missing parameters are: addLicenses.

This error occurs in PowerShell when you attempt to remove a user license using the Set-MgUserLicense cmdlet without including the -AddLicenses parameter.

Fix

The -AddLicenses parameter is mandatory in Set-MgUserLicense cmdlet. Therefore, even if you are only removing a license, you must pass an empty value for -AddLicenses, as shown below.

Set-MgUserLicense -UserId <UPN> -RemoveLicenses @("<license-guid>") -AddLicenses @()

Error Get-MgUserLicenseDetail : Resource '<UserPrincipalName>' does not exist or one of its queried reference-property objects are not present.

This error occurs when executing the Get-MgUserLicenseDetail cmdlet with an invalid or non-existent UserId or UPN in Microsoft Graph PowerShell.

Fix

Ensure that the user exists and is not deleted or hidden. And verify that the UPN or object ID you are using is correct by running the below cmdlet.

Get-MgUser -UserId "<UserPrincipalName>"

Error The term 'Search-UnifiedAuditLog' is not recognized as a name of a cmdlet, function, script file, or executable program.

This error occurs when the Exchange Online PowerShell module is not installed or imported before establishing a connection to find disabled users.

Fix

Install and import the Exchange Online PowerShellmodule using the following cmdlets, then proceed to connect to the module.

Install-Module ExchangeOnlineManagement 
Import-Module ExchangeOnlineManagement

Error Cannot process argument transformation on parameter 'EndDate’. Cannot convert value “24-06-2025” to type “System.DateTime”. Error: “String ‘24-06-2025’ was not recognized as a valid DateTime.”

This error occurs when executing the Search-UnifiedAuditLog cmdlet using a date format that is either unsupported or does not match your system’s regional settings.

Fix

Change the date format in the cmdlet to match your system’s regional settings or use a universally accepted format like 'YYYY-MM-DD'.

Error ./AuditUserAccountStatusChanges.ps1 cannot be loaded because running scripts is disabled on this system.

This error occurs when Windows PowerShell blocks the execution of the script due to security restrictions.

Fix

To resolve this error, temporarily set the execution policy to bypass the restriction using the following cmdlet.

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
Microsoft Entra ID
Frequently Asked Questions

Track Re-enabled User Accounts in Microsoft 365 for Better Oversight

How to re-enable a user account in Microsoft 365?
How long does it take for a re-enabled Microsoft 365 user to regain access?
What happens after re-enabling a disabled Microsoft 365 user account?
How to ensure a Microsoft 365 license is not activated when a user account is re-enabled?
Can a re-enabled user be blocked by Conditional Access or security policies?
How to ensure users are not blocked after re-enablement in a hybrid setup?

1. How to re-enable a user account in Microsoft 365?

When a user’s sign-in is blocked due to security concerns, suspicious activity, or policy violations, they lose access to Microsoft 365 services like Teams and OneDrive. After verifying the account is secure, admins may need to re-enable the user’s sign-in to restore access and ensure business continuity. Follow the steps below to re-enable the user and quickly restore their access while ensuring your environment stays protected.

Note: To re-enable a disabled user account in Microsoft 365, you must have Global Admin or User Admin privileges.

Re-enable user accounts using Microsoft 365 admin center

You can re-enable sign-in–blocked users by selecting them on the Active users page in the Microsoft 365 admin center and clicking Unblock sign-in option. However, only up to 50 users can be selected and unblocked at a time. If more than 50 users need to be unblocked, it must be performed in multiple batches, which is time-consuming and requires additional effort.

Re-enable sign-in blocked users using Microsoft Entra admin center

To manually re-enable a disabled user account in the Entra admin center, follow the steps below.

  • In the Entra admin center, navigate to Entra ID » Users » All users.
  • Click on the Add filter option and select Account enabled.
  • Under the filter box, you will see a Value toggle set toYes by default. To find disabled users, switch the toggle to No and click ‘Apply’.
  • Once the list of disabled users appears, locate and select the user account you want to re-enable.
  • In the user’s profile, locate the Account status card and click the Edit link.
  • Now, select the Account enabled check box and click Save to re-enable the user account.
re-enable-sign-in-blocked-users-entra

Note: If you need to re-enable multiple accounts at once, you can use the New Bulk Edit Users (Preview) feature in Microsoft Entra. This allows you to select and update multiple users simultaneously.

Restore Microsoft 365 user sign-in access using PowerShell

Even though bulk actions are available in the Microsoft Entra admin center, PowerShell offers more flexibility, scale, and automation for updating user accounts. Here’s how to re-enable an account using PowerShell.

  • Connect to the Microsoft Graph PowerShell module using the cmdlet below.
    Connect-MgGraph -Scopes "User.ReadWrite.All"
  • Run the command below to enable the account status of a Microsoft 365 user.
    Update-MgUser -UserId "<UserPrincipalName>" -AccountEnabled

#Replace <UserPrincipalName> with the user’s actual UPN.

Quickly enable multiple users with AdminDroid’s management actions!

  • With AdminDroid’s management capabilities, you can directly re-enable users from the disabled users report.
  • Simply select the users you want to enable, click Enable User, and then click Enable in the dialog box.
  • Using AdminDroid’s advanced controls, you can Pause an action, review changes, Undo specific or all operations. Afterwards, you can safely Resume the process without any interruption.
enable-multiple-users-admindroid

2. How long does it take for a re-enabled Microsoft 365 user to regain access?

When an administrator blocks a user account, it immediately prevents any new sign-ins for that account. If the user is already signed in, their existing sessions across all Microsoft 365 services are automatically invalidated and signed out within approximately 60 minutes. However, this does not stop the account from receiving email and does not delete any data. This helps quickly contain potential security risks.

After the issue is investigated and resolved, the administrator can re-enable the user account using admin portals or PowerShell. Once done, within 10–15 minutes, the user is usually able to sign in again. This is because Microsoft Entra ID updates authentication status quickly across its identity services. However, full access to Microsoft 365 workloads is restored gradually, not instantly.

  • Outlook and OneDrive access typically becomes available within a few hours after re-enablement. 
  • Microsoft Teams access can take up to 24 hours to fully restore, as Teams relies on additional backend synchronization and policy evaluations.

During this period, the user may notice that they can sign in successfully but still see limited or missing access to certain services. This behavior is expected and temporary. Several factors can further influence how long it takes for access to be fully restored, including:

  • Conditional Access policies 
  • MFA enforcement or re-registration 
  • License removal and re-assignment
  • Device compliance or Intune policies 
  • Risk-based sign-in protections

In environments with strict security controls, users may be prompted to reauthenticate, complete MFA challenges, or sign in again after policies are re-evaluated. As a result, sign-in access will be restored quickly, but complete service availability can take several hours.

3. What happens after re-enabling a disabled Microsoft 365 user account?

When a user account is re-enabled after being blocked, restoration of access to Microsoft 365 services depends on how license assignment is managed during the disabled period. Understanding this behavior is critical to preventing unintended data loss, ensuring service continuity, and planning secure user recovery after incidents such as account compromise or temporary suspensions.

If the license was retained during the disabled state

  • The user regains access to Microsoft 365 services such as Exchange Online, OneDrive, Teams, SharePoint, and Microsoft 365 apps after re-enabling.
  • All data remains intact, and no further administrative action is needed.

If the license was removed while the account was disabled

  • An admin must reassign it through the Microsoft 365 admin center, PowerShell, or group-based licensing. Until then, access to services remains restricted, and Microsoft 365 apps may operate in reduced functionality mode.
  • Data is preserved temporarily, but restoration depends on how soon the license is reapplied:

    Mailbox: Retained for 30 days after license removal. After that, it may be deleted unless protected by retention policies or litigation hold.

    OneDrive: Retained for 30 days by default. During this time, other users can still access shared content. At the end of this period, the OneDrive remains in a deleted state for 93 days and can only be restored by a SharePoint Administrator.

    Teams, SharePoint, and Microsoft 365 apps: Access resumes only after the license is reassigned. Until then, services may be inaccessible or enter reduced functionality mode.

Additional points to be noted

  • Microsoft 365 Static Groups: Disabled users remain members, and access is automatically restored after re-enablement and license assignment.
  • Microsoft 365 Dynamic Groups: If a user is disabled, they are automatically removed from groups with the membership rule accountEnabled -eq true. Once the account is re-enabled, they are automatically added back.
  • Private Teams / Private Channels: For private teams and channels that use the dynamic membership rule 'accountEnabled -eq true', users are automatically removed when their account is disabled. However, re-enabling the user account does not automatically restore their membership or access to the private channel. A team owner must manually add the user back after the account is re-enabled.
  • Public Teams: Disabled users are not removed, and access is restored automatically after re-enablement and licensing.

4. How to ensure a Microsoft 365 license is not activated when a user account is re-enabled?

Once a user account is re-enabled, any previously assigned licenses are automatically reactivated, immediately restoring access to Microsoft 365 services. This can be problematic in scenarios where access should remain restricted, such as during security investigations, phased user reactivation, role changes, or when licenses are being optimized to avoid unnecessary consumption. To prevent unintended service access and unnecessary license usage, administrators should ensure that licenses are removed from the user account before or during the re-enablement process.

Remove Microsoft 365 license before re-enabling a user account

  • Go to the Microsoft 365 admin center.
  • Navigate to Users » Active users and select the user account you intend to re-enable.
  • Under the Licenses and apps tab, uncheck the assigned license and click Save changes.
remove-license-re-enabling-user-m365

Unassign Microsoft 365 licenses from users using PowerShell

  • First, connect to the Microsoft Graph PowerShell module using the cmdlet below.
     Connect-MgGraph -Scopes "User.ReadWrite.All"
  • To remove a specific license from a user, run the PowerShell cmdlet below. Replace <UserUPN> with the specific user principal name and <license-guid> with the actual SKU ID of the license you want to remove.
    Set-MgUserLicense -UserId <UserUPN><upn> -RemoveLicenses @("<license-guid><license-guid>") -AddLicenses @()</license-guid></upn>

Handry Tip: To retrieve the SKU ID of the license assigned to a user in Microsoft 365, run the following PowerShell cmdlet after replacing <UserUPN> with the appropriate user principal name.

Get-MgUserLicenseDetail -UserId <UserUPN>

Don’t miss any licenses; find and reclaim unused ones with AdminDroid!

  • To reduce administrative overhead, AdminDroid provides a dedicated recoverable user licenses report that lists licenses assigned to users with disabled sign-ins.
  • This report offers detailed insights into license-assigned users, assigned subscriptions, product licenses, and more.
  • Using AdminDroid’s management action, you can remove a license directly from the report. Simply select the user, click Remove License, choose the license, and click Delete.
reclaim-unused-license-admindroid

5. Can a re-enabled user be blocked by Conditional Access or security policies?

While Conditional Access is a powerful tool for securing Microsoft 365, it’s not foolproof. Policies may be overly restrictive or misconfigured, which can result in legitimate users being blocked, especially after account changes like re-enabling. Here are the main reasons for these blocks, along with steps to troubleshoot and resolve access issues efficiently.

Key reasons why a re-enabled user might be blocked

  • Conditional Access Policies: Policies requiring multi factor authentication, device compliance, or trusted locations can block access if conditions aren’t met.
  • Security Defaults: Enabled security defaults block legacy authentication and block users who do not have MFA registered.
  • User Risk Policies: Security policies may classify a user as “high risk” based on accumulated detections. However, if these policies block users who cannot self-remediate (e.g., by performing a secure password change), their access will be blocked.
  • Group Membership Misconfigurations: Incorrect group memberships or exclusions can apply restrictive policies to the user.

Troubleshooting access issues after re-enabling a user

  • Check Conditional Access Policies: In the Microsoft Entra admin center, check Sign-in logs to analyze Conditional Access policy impacts. Then examine the policies affecting the users and evaluate them in Report-only mode.
  • Verify Group Membership: Ensure the user isn’t in a group with restrictive policies or excluded from required ones.
  • Check Security Defaults: Confirm if security defaults are enabled (Microsoft Entra ID » Overview » Properties » Manage security defaults) and ensure MFA registration.
  • ️Ensure MFA Registration: Verify the user’s MFA setup by navigating to Microsoft Entra ID » Users » Select a user » Authentication methods.
  • Update Device Compliance: Ensure the user’s device is enrolled and compliant in Microsoft Intune if required.
  • Address Risk-Based Blocking: If re-enabled users are flagged as risky by Microsoft and blocked by risk-based Conditional Access policies, resetting the user’s password can remediate the risk state and restore access.

Gain insights into users blocked by conditional access policies with AdminDroid!

While the above approaches help mitigate potential causes of blocked access, identifying the exact Conditional Access policy that hindered user sign-ins is crucial.

  • To simplify this analysis, AdminDroid provides clear visibility into users blocked by CA policies through the User Sign-ins Successfully Blocked by Conditional Access Policy report.
  • This report provides detailed information such as the user who was blocked, the application where the sign-in was blocked, the specific policy that triggered the block, and more.
users-blocked-ca-policies-admindroid

6. How to ensure users are not blocked after re-enablement in a hybrid setup?

In a hybrid Microsoft 365 environment, re-enabling a blocked user is not just a cloud-only action. While it may appear that enabling user sign-in in Microsoft Entra is sufficient, the authoritative source of the user account is on-premises Active Directory. This means that simply switching the sign-in status to enabled in Microsoft Entra ID may not fully restore access if the on-premises account remains disabled or if synchronization does not occur as expected.

Therefore, it is essential to follow a structured approach to ensure they regain full access when re-enabling. The following key practices address the critical areas to review for a seamless restoration of sign-in for blocked users in a hybrid environment.

  • Verify On-Premises Account Status Ensure that the user is re-enabled in both the M365 and on-premises environments to prevent directory synchronization conflicts.
  • Re-Enable in Active Directory and Trigger Sync Sometimes users are re-enabled only in Active Directory (AD). In such cases, the change must be synchronized to Microsoft 365 to take effect. Trigger a directory synchronization (for example, using Azure AD Connect Sync Now) to push updates immediately.
  • Check OU Filtering in Synchronization If the user’s organizational unit (OU) is excluded from synchronization, changes made in Active Directory may not propagate to Microsoft 365. Verify that the OU containing the user is included in the sync scope to ensure the AD re-enabled status is applied in the cloud.
  • Confirm Password Hash Synchronization The cloud relies on synchronized password hashes when dealing with a hybrid setup and synced users. Ensure that password hash sync is active and up to date for the user account, as inactive or delayed synchronization can keep users blocked.

Kickstart Your Journey With
AdminDroid

Your Microsoft 365 Companion with Enormous Reporting Capabilities

Download Now
Browse All Guides
User Help Manuals Compliance Docs Customer Stories
All Guides 99+
Microsoft Entra ID
Track Sign-in Re-Enabled Events for Users in Microsoft 365
Microsoft Entra ID Guides