How To: Manage inactive user accounts
In large environments, user accounts aren't always deleted when employees leave an organization. As an IT administrator, you want to detect and resolve these obsolete user accounts because they represent a security risk.
This article explains a method to handle obsolete user accounts in Microsoft Entra ID.
This article applies only to finding inactive user accounts in Microsoft Entra ID. It does not apply to finding inactive accounts in Azure AD B2C.
What are inactive user accounts?
Inactive accounts are user accounts that aren't required anymore by members of your organization to gain access to your resources. One key identifier for inactive accounts is that they haven't been used for a while to sign in to your environment. Because inactive accounts are tied to the sign-in activity, you can use the timestamp of the last time an account attempted to sign in to detect inactive accounts.
The challenge of this method is to define what for a while means for your environment. For example, users might not sign in to an environment for a while, because they are on vacation. When defining what your delta for inactive user accounts is, you need to factor in all legitimate reasons for not signing in to your environment. In many organizations, the delta for inactive user accounts is between 90 and 180 days.
The last sign-in provides potential insights into a user's continued need for access to resources. It can help with determining if group membership or app access is still needed or could be removed. For external user management, you can understand if an external user is still active within the tenant or should be cleaned up.
Detect inactive user accounts with Microsoft Graph
You can detect inactive accounts by evaluating the
lastSignInDateTime property exposed by the
signInActivity resource type of the Microsoft Graph API. The
lastSignInDateTime property shows the last time a user attempted to make an interactive sign-in attempt in Microsoft Entra ID. Using this property, you can implement a solution for the following scenarios:
Last sign-in date and time for all users: In this scenario, you need to generate a report of the last sign-in date of all users. You request a list of all users, and the last
lastSignInDateTimefor each respective user:
Users by name: In this scenario, you search for a specific user by name, which enables you to evaluate the
Users by date: In this scenario, you request a list of users with a
lastSignInDateTimebefore a specified date:
https://graph.microsoft.com/v1.0/users?$filter=signInActivity/lastSignInDateTime le 2019-06-01T00:00:00Z
signInActivity property supports
le) but not with any other filterable properties. You must specify
$filter=signInActivity while listing users, as the signInActivity property is not returned by default.
What you need to know
The following details relate to the
The property is not available through the Get-MgAuditLogDirectoryAudit cmdlet.
To access the property, you need a Microsoft Entra ID P1 or P2 edition license.
To read the property, you need to grant the app the following Microsoft Graph permissions:
Each interactive sign-in attempt results in an update of the underlying data store. Typically, sign-ins show up in the related sign-in report within 6 hours.
To generate a
lastSignInDateTimetimestamp, you must attempt a sign-in. Either a failed or successful sign-in attempt, as long as it's recorded in the Microsoft Entra sign-in logs, generates a
lastSignInDateTimetimestamp. The value of the
lastSignInDateTimeproperty might be blank if:
- The last attempted sign-in of a user took place before April 2020.
- The affected user account was never used for a sign-in attempt.
The last sign-in date is associated with the user object. The value is retained until the next sign-in of the user. It might take up to 24 hours to update.
How to investigate a single user
Steps in this article may vary slightly based on the portal you start from.
If you need to view the latest sign-in activity for a user, you can view the user's sign-in details in Microsoft Entra ID. You can also use the Microsoft Graph users by name scenario described in the previous section.
Browse to Identity > Users > All users.
Select a user from the list.
In the My Feed area of the user's Overview, locate the Sign-ins tile.
The last sign-in date and time shown on this tile might take up to 24 hours to update, which means the date and time might not be current. If you need to see the activity in near real time, select the See all sign-ins link on the Sign-ins tile to view all sign-in activity for that user.