Internal Microsoft - Need non-person account disabled

Question

Internal Microsoft - Need non-person account disabled

Andy Montgomery 0 Microsoft Employee

We are an internal Microsoft team in the Microsoft Entra tenant. I need a non-person account in the same tenant that I own disabled. The account was created in Core Identity and cannot be disabled there. The only available option is delete.

Following safe deployment/change management I need the account to be disabled for several before deletion so we can observe any unexpected impact. The option to disable the account in Azure/Entra Management Portal is greyed out.

While this is not really a question, the support options only allow direct ticket creation for Sev A and this is not that.

Rayyan Fawad 1,075 Reputation points

2026-06-06T16:27:27.2033333+00:00

That greyed-out button is a classic sign of an administrative "Source of Authority" conflict in Microsoft Entra ID. Because this non-person or service account was originally created in your local, on-premises Active Directory and synced up to the cloud via Entra Connect, the cloud portal treats it as read-only. You can’t disable or change its status directly in the Entra web dashboard because your local server is still running the show.

To fix this right now, just hop onto your local on-premises Domain Controller, open Active Directory Users and Computers, find the service account, and right-click to disable it there. Once the next automatic sync cycle runs (usually every 30 minutes), the changes will push to the cloud and update the account status for you. If you want to cut the cord entirely and manage it 100% in the cloud moving forward, you can move the account to an unsynced Organizational Unit (OU) locally to break the hybrid link, let it delete in the cloud, and then simply hit "Restore User" from your Entra Deleted Users folder to convert it into a fully cloud-managed object that you can toggle on or off anytime!
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-08T01:30:30.44+00:00

Andy Montgomery

Thank you for reaching out to Microsoft Q&A.

I will connect with you on Teams shortly !

Your answer

Rayyan Fawad 1,075 Reputation points

2026-06-06T16:27:27.2033333+00:00

That greyed-out button is a classic sign of an administrative "Source of Authority" conflict in Microsoft Entra ID. Because this non-person or service account was originally created in your local, on-premises Active Directory and synced up to the cloud via Entra Connect, the cloud portal treats it as read-only. You can’t disable or change its status directly in the Entra web dashboard because your local server is still running the show.

To fix this right now, just hop onto your local on-premises Domain Controller, open Active Directory Users and Computers, find the service account, and right-click to disable it there. Once the next automatic sync cycle runs (usually every 30 minutes), the changes will push to the cloud and update the account status for you. If you want to cut the cord entirely and manage it 100% in the cloud moving forward, you can move the account to an unsynced Organizational Unit (OU) locally to break the hybrid link, let it delete in the cloud, and then simply hit "Restore User" from your Entra Deleted Users folder to convert it into a fully cloud-managed object that you can toggle on or off anytime!
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-08T01:30:30.44+00:00

Andy Montgomery

Thank you for reaching out to Microsoft Q&A.

I will connect with you on Teams shortly !