Identifier Reuse

Pick a period, write it down, and the hard half is done.

Objective [a] is satisfied by a sentence in your identifier policy: usernames and device identifiers are not reassigned to a different person or device for a defined period. A two-year period is a defensible choice. Objective [b] is whatever mechanism makes that sentence true.

Never deleting accounts is the cheapest prevention.

Disable departed users and keep the objects: a disabled-users organizational unit on premises, sign-in-blocked accounts in Microsoft Entra ID. While the object exists, the directory itself refuses to issue that identifier again, which enforces [b] with no extra machinery.

The same person can come back to the same identifier.

The assessment guide's discussion says preventing reuse means preventing previously used identifiers from going to different individuals, groups, roles, or devices. A rehired employee reclaiming their old username is not the risk this requirement targets. Write the allowance into the policy and reactivate the account.

Do not invent an obfuscation program.

Nothing here requires usernames that differ from email addresses or anonymized account names. Matching the sign-in name, the user principal name, to the mailbox is fine. The requirement is only that identifiers are not recycled onto someone new.