I am trying to automate disabling Microsoft Teams licenses for users not connected for more than 180 days. In order to achieve this, I currently try to extract a report of users by signin activity, and then based on this select those with an activity greater than 6 months and remove their license. My current (not working) code is the following: get-mguser -All ` -property signinactivity | Select-Object DisplayName -expandproperty signinactivity | Export-CSV "C:\temp\LastActivity.csv" -NoTypeInformation $InputFile = "c:\temp\LastActivity.csv" [array]$Users = Import-CSV $InputFile If (LastSignInDateTime -gt 6 months) ForEach ($User in $Users) { try { $License = Set-MgUserLicense -UserId $User.UPN -AddLicenses @() -RemoveLicenses @('18181a46-0d4e-45cd-891e-60aabd171b4e') -ErrorAction:Continue; } catch { Write-Warning -Message "Script failed while attempting to set the licence for $($User.UPN). Aborting."; throw; } } I see two main issues: first is the signinactivity I obtain which is not the Teams last signinactivity. The second is the command If (LastSignInDateTime -gt 6 months) that obviously does not work as is, I do not find how to make it work based on the report generated previsouly. Does anyone see how I can tweak my code to achieve the desired result?

The signinactivity property does not represent Teams activity, as you've noted. If that's what you are interested in, best leverage the Teams activity report: Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/reports/getTeamsUserActivityUserDetail(period='D7')?`$format=application/json" Or go the easy route and "borrow" Tony's code here: https://office365itpros.com/2022/08/08/microsoft-365-user-activity-2022/

How to get Teams last signin activity and then remove license?

Accepted answer

Vasil Michev 100.2K Reputation points MVP

2024-01-25T08:48:12.55+00:00
The signinactivity property does not represent Teams activity, as you've noted. If that's what you are interested in, best leverage the Teams activity report:

Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/reports/getTeamsUserActivityUserDetail(period='D7')?`$format=application/json"

Or go the easy route and "borrow" Tony's code here: https://office365itpros.com/2022/08/08/microsoft-365-user-activity-2022/
Please sign in to rate this answer.
Damien 20 Reputation points

2024-01-25T11:32:18.04+00:00

Thank you for your answer Vasil, however when I type in the command you give I get an error message which I do not manage to make any sense of:

InvokeGraphHttpResponseException,Microsoft.Graph.PowerShell.Authentication.Cmdlets.InvokeMgGraphRequest

Damien 20 Reputation points

2024-01-25T11:34:06.1233333+00:00

Thank you for your answer Vasil, however when I type in the command you give I get an error message which I do not manage to make any sense of: InvokeGraphHttpResponseException,Microsoft.Graph.PowerShell.Authentication.Cmdlets.InvokeMgGraphRequest

Vasil Michev 100.2K Reputation points MVP

2024-01-25T15:08:04.3666667+00:00

The example above requires the Reports.Read.All permission, so try adding this:

Connect-MgGraph -Scopes Reports.Read.All

LiweiTian-MSFT 16,845 Reputation points Microsoft Vendor

2024-01-29T05:13:10.93+00:00

Hi @Damien

If the reply is helpful to you, please try to mark it as an answer to help others who encounter the same issue and read this thread.
Thank you for your understanding and patience!

Damien 20 Reputation points

2024-01-29T08:00:05.7233333+00:00

Hello, I have been granted the Report Reader as well as Security Administrator rights, but still cannot connect with the scope Reports.Read.All. Our security team is reluctant to grant global administrator rights, do you see the lowest rights level which I should be granted in order to connect with the Reports scope ?

Vasil Michev 100.2K Reputation points MVP

2024-01-29T08:21:21.8866667+00:00

Damien, it's not just your user that needs to have permissions, the application itself needs them, too. In this case, the Graph SDK for PowerShell must have Reports.Read.All consented to in order to fetch this data, and to do that, you need to run

Connect-MgGraph -Scopes Reports.Read.All

If you don't have the necessary permissions to consent, ask an admin to do so. They DO NOT need to grant you global admin rights.

Damien 20 Reputation points

2024-01-29T16:03:28.37+00:00

Thanks Vasil, this is exactly the command I run, which brings me to a popup where I have to choose the account, I choose mine with the appropriate rights (Reports Reader), but then it tells me that I need an administrator to grant me the necessary rights. When I check in Entra ID, I have indeed the Report Reader and Security Administrator roles, which should be enough for what I need here.

Vasil Michev 100.2K Reputation points MVP

2024-01-29T17:36:03.91+00:00

An admin will need to run this step, only after consent has been granted it will work for you, too.

Damien 20 Reputation points

2024-02-14T08:49:04.8266667+00:00

Thanks Vasil, after the intervention of an admin (who ran the command on his own computer) it works correctly now, I am able to extract the report to a file.I have finalized my script, it works as intended, I'm sharing it here for those interested :

Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/reports/getTeamsUserActivityUserDetail(period='D7')?" -OutputFilePath C:\temp\Teams1.csv $InputFile = "c:\temp\Teams1.csv" [array]$Users = Import-CSV $InputFile $date1 = (Get-Date).AddDays(-180) ForEach ($User in $Users) { try { If ($User.'Last Activity Date') { If ([DateTime]$User.'Last Activity Date' -lt $date1) { Set-MgUserLicense -UserId $User.'User Principal Name' -AddLicenses @() -RemoveLicenses @('18181a46-0d4e-45cd-891e-60aabd171b4e') -ErrorAction:Continue; } } } catch { Write-Warning -Message "Script failed while attempting to set the licence for $($User.'User Id'). Aborting."; throw; } }
Sign in to comment

Share via

How to get Teams last signin activity and then remove license?

0 additional answers