For a license clean-up I need a full list of every disabled account in our Microsoft 365 tenant, not just check them one at a time. When I open a user I can see "Sign-in blocked" on some of them, but scrolling the whole Active users list looking for it is hopeless. Is "disabled" the same as sign-in blocked in Microsoft 365, and what is the fastest way to pull a complete list I can hand to management and use to reclaim licenses?
How to Find All Disabled (Sign-In Blocked) Users in Office 365
Resolved
Cloud
CM
Community Member August 23, 2026
6 replies
1,047 views
Reviewed by moderators
6 Answers
Yes, in Microsoft 365 "disabled" and "sign-in blocked" are the same thing. Under the hood each account has an AccountEnabled attribute: true means the person can sign in, false means they are blocked, which the admin center displays as "Sign-in blocked". There is no separate "disabled" flag, so when you filter or report on blocked sign-in you are listing exactly the disabled accounts.
You can get the full list three ways: the Microsoft 365 admin center, the Microsoft Entra admin center, or Graph PowerShell. For a one-off audit the admin center filter is quickest, for a repeatable report PowerShell wins.
Microsoft 365 admin center method: go to Users, then Active users. Open the Filter menu and add or pick a filter with Sign-in status set to "Sign-in blocked". The list instantly narrows to just the disabled accounts. If you create it as a named custom filter (for example call it "Sign-in Blocked"), it stays available for next time.
To get it as a file, on the same Active users page use the three-dot menu and Export users. Open the CSV and look at the Block credential column, True means the account is disabled, False means enabled.
Microsoft Entra admin center method, which gives you the cleanest built-in filter: go to Identity, Users, All users, click Add filter, choose Account enabled, set the value toggle to No, and Apply. You now see every account whose sign-in is disabled across the tenant. This view is handy because you can add columns like last sign-in to judge which blocked accounts are safe to remove.
Graph PowerShell, the best route for a report you will rerun. Connect first, then filter on AccountEnabled:
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -All -Filter "accountEnabled eq false" | Select-Object DisplayName,UserPrincipalName
That prints every disabled user. Putting the filter in the -Filter string is important, it makes Graph return only disabled users rather than pulling the whole directory and filtering afterward, which matters on large tenants.
To hand something to management, export it to CSV with the columns they care about:
Get-MgUser -All -Filter "accountEnabled eq false" -Property Id,DisplayName,UserPrincipalName,Mail,Department,UserType,AccountEnabled | Select-Object DisplayName,UserPrincipalName,Mail,Department | Export-Csv -Path "C:\Reports\DisabledUsers.csv" -NoTypeInformation
For the license reclaim you are doing, this list is your worklist: each disabled account that still holds a license is a license you can free up. Cross-check the CSV against assigned licenses and remove them from accounts nobody will re-enable.
Two things worth knowing before you act on the list. First, accounts get disabled for a range of reasons, deliberate offboarding, a security review, or Microsoft auto-blocking after risky or suspicious sign-ins, so a blocked account is not automatically a safe delete, confirm before removing anyone. Second, if your tenant syncs from on-premises Active Directory, the enabled or disabled state is controlled on-premises, an account shows blocked in Microsoft 365 because it is disabled in your local AD, and you re-enable it there, not in the cloud. For cloud-only accounts you manage the state directly in Microsoft 365.