Accounts with no sign-in activity are detected from directory data. A request goes to the manager or HR for confirmation; on approval, sign-in is blocked, sessions are revoked, the mailbox is converted, and the license returns to the pool.