Find Azure users who have not signed in within 90 day's / Inactive users.

Question

Looking to list all inactive users using powershell.

Ive tried many methods such as Get-Aduser etc. but I always find recent users within the list.

Looking to query Azure AD so I can also get cloud accounts

Ive arrived at below.

$users = Get-AzureADUser -All:$true | Where-Object { $_.AccountEnabled -eq $true }

 

$inactiveUsers = $users | Where-Object {

    $_.SignInActivity.DateTime -lt (Get-Date).AddDays(-90)

} | Select-Object DisplayName, UserPrincipalName, UserType, CreationType

$inactiveUsers 

However i find far too many results in the list and when I query some of these users I seen they have signed in within the last week showing that the script is not working as intended.

I'm wondering if what I'm looking to do is possible.

Find all users who have not signed in within the last 90 days?

Thanks

Answer 1

Hi @Synthetic-Sentience , to find Azure users who have not signed in within the last 90 days, you can use the Microsoft Graph API to query the lastSignInDateTime property. The PowerShell script you provided uses the AzureAD module, which doesn't expose the lastSignInDateTime property. Instead, you should use the Microsoft Graph API to get the desired information.

Here's a PowerShell script that uses the Microsoft Graph API to find inactive users:

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph

$inactiveDate = (Get-Date).AddDays(-90)

$users = Get-MgUser -All:$true -Property Id, DisplayName, UserPrincipalName, UserType, SignInActivity | Where-Object { $_.AccountEnabled -eq $true }

$inactiveUsers = $users | Where-Object {
    $_.SignInActivity.LastSignInDateTime -lt $inactiveDate
} | Select-Object DisplayName, UserPrincipalName, UserType

$inactiveUsers

This script installs the Microsoft.Graph module, connects to the Microsoft Graph API, and retrieves all users with their SignInActivity. It then filters the users based on their lastSignInDateTime property and the specified inactive date (90 days ago).

Please note that you need to have the necessary permissions to access the lastSignInDateTime property. You need to grant the following rights: AuditLog.Read.All and Directory.Read.All.

Keep in mind that the lastSignInDateTime property might be blank if the last successful sign-in of a user took place before April 2020 or the affected user account was never used for a successful sign-in. More information here.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark it as "Verified" so other users can reference it.

Thank you,

James