How to set a Microsoft Entra ID account to expire on a date

On-premises Active Directory has had an accountExpires attribute for decades: set a date on a contractor or intern account, and it disables itself when that date passes. Cloud Microsoft Entra ID (formerly Azure AD) still has no equivalent. This is one of the most requested identity features on the feedback forum, with well over a thousand votes and years of comments from admins who onboard temporary staff.

The result is that most teams fall back to a calendar reminder and a manual disable, which is easy to miss and leaves orphaned, still-enabled accounts as a standing security and compliance risk.

What Entra ID gives you today

No native account expiry date. There is no field to say "disable this account on this date."
Lifecycle Workflows and Access Reviews can help, but they are Microsoft Entra ID Governance / P2 features (an added per-user license), and they are oriented toward joiner and leaver flows and periodic guest reviews rather than a simple per-account expiry date.
Guest cleanup for stale external users is a separate problem with the same root cause: no built-in "disable after N days of no sign-in."

The DIY approach: a stored date plus a scheduled disable

You can reproduce accountExpires with a little glue:

Store an intended end date on each temporary account. A common choice is the employeeLeaveDateTime property, or a custom extension attribute.
Run a scheduled job (Azure Automation runbook, a Function on a timer, or a scheduled pipeline) daily that queries Microsoft Graph for accounts whose end date has passed and disables them by setting accountEnabled to false.
Add warning steps so the owner and manager get a heads-up a few days before, not a silent disable on the day.
Give the job identity the least-privilege Graph permission it needs and log every action.

This is reliable once built, but it is code you now own, test, and keep running as the Graph API and your directory evolve.

A ready-made option: Identity Lifecycle

Our tool for this: Identity Lifecycle on the Azure Marketplace. It deploys into your own tenant as a managed application, so nothing leaves your environment and there is no vendor backend.

Identity Lifecycle adds the expiry date Entra is missing. You set an end date on any contractor, temp, or intern account, and it warns at 14, 7, and 1 days, then disables the account on the date. The same app also cleans up stale guests: it flags guests with no recent sign-in, reports them to Microsoft Teams, and disables them after a grace period you choose. It runs entirely in your own tenant under a managed identity you control and ships dry-run by default, so you review the report before anything changes.

Key facts

Native Entra account expiry: none, unlike on-prem AD.
Governance features (P2): partial, license-gated, not a simple per-account date.
DIY: store an end date plus a daily Graph job that disables expired accounts.
Removes access only: disabling an account is reversible and does not delete data.

Related reading: how to put a hard spending cap on Azure.

Written by the team at Katabarwa Labs. We build small, single-purpose Azure tools that run entirely inside your own tenant. Questions: abaho@llmgraph.ai.