How to Identify stale Azure AD Enterprise Applications and App Registrations

Question

Hi,

I am looking to report on Enterprise Applications that have had no sign ins for the past 30/60 days using automation such as PowerShell scripting.

I have found the usage and insights preview feature in Azure AD but I don't think this is delivering what I need, it only appears to show applications that have had a successful or failed sign in. I want to know what applications are completrly stale.

Assuming there is some MS Graph cmdlets for this or some KQL that can be run to pull back what I need and was hoping there was something out there already I could use!

Thanks

Answer 1

Here is a sample PowerShell script to retrieve the list of Enterprise Applications that have had no sign-ins for the past 30/60 days. This sample PowerShell script uses the Azure AD PowerShell module:

# Connect to Azure AD
Connect-AzureAD

# Set the number of days to check for stale applications
$staleDays = 30

# Get the list of enterprise applications
$apps = Get-AzureADServicePrincipal -All $true

# Filter out the applications that have had a sign-in within the last $staleDays days
$staleApps = $apps | Where-Object { 
    (Get-AzureADAuditSignInLogs -ObjectId $_.ObjectId -All $true -Top 1).createdDateTime -lt (Get-Date).AddDays(-$staleDays) 
}

# Display the list of stale applications
$staleApps | Select-Object DisplayName, AppId

You can adjust the $staleDays variable to set the number of days that you want to check for stale applications. You can also modify the Select-Object statement to display additional properties if needed.

Answer 2

As others have stated, the command does not have a argument "ObjectID". This should be managed using a filter.

Also the script calculates the date for each app.

Thirdly, all Microsoft Apps are also checked.

I use a modified script (still tweaking it so it might not be perfect):

# Connect to Azure AD 
Connect-AzureAD 

# Set the number of days to check for stale applications $staleDays = 30
$DropOffDate = (Get-Date).AddDays(-$staleDays)

# Get the list of enterprise applications
$apps=Get-AzureADServicePrincipal -all $true | where {(-not [string]::IsNullOrEmpty($_.AppDisplayName)) -and $_.PublisherName -ne "Microsoft Services" -and $_.AccountEnabled -eq $true}

#Filter out the applications that have had a sign-in within the last $staleDays days
$staleApps = $apps | Where-Object {
      (Get-AzureADAuditSignInLogs -filter "appId eq '$($_.AppId)'").createdDateTime -lt $DropOffDate
}
# Display the list of stale applications
$staleApps | Select-Object AppDisplayName, AppId