Dynamic Group For SSO Activity

Question

I've scavenged the internet and can't find a single similar post.

I'm trying to create a dynamic group that removes users who haven't single sign on into a specified application.

Some context: We're trying to control access to an application that is assigned to all users, but want to remove users who have never used it to control costs. Any ideas would be helpful, or if theres a better way to do it then please.

I'm thinking something like:

(objectCategory=Application ID X )(objectClass=user)(|(lastLogonTimestamp=0)

Answer 1

Hi @Metayer Jr, Nesly

Thank you for reaching out. Based on the use case explained you can create a new access review for the specific application.

While creating the access review you may also choose to configure Enable review decision helpers if you would like to receive recommendations during the review process.
If you select No sign-in within 30 days, users who have signed in during the previous 30-day period are recommended for approval. Users who haven't signed in during the past 30 days are recommended for denial.

As you would be creating an access review based on applications, your recommendations are based on the 30-day interval period depending on when the user last signed in to the application rather than the tenant.

For detailed steps on creating an access review please follow the below documentation.
Prepare for an access review of users' access to an application
Create an access review of groups and applications in Azure AD

I hope this answers your query.

----------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.