Using Microsoft Graph to find Inactive Azure AD Users

Question

Using Microsoft Graph to find Inactive Azure AD Users

Son 316

Hi,

I need assistance trying to locate cloud only Azure AD users in our tenant that have not logged in for 90 days or more.

I am trying to achieve this using the Microsoft Graph API and PowerShell but I am relatively new to the concept and it is different.

Eventually I would want this automated using a Scheduled Task to run a PowerShell script but for now I would like to achieve the results interactively but I am struggling to find the cmdlets to run to pull back the information.

I am unable to locate the last sign in date attribute that I would need to build this into a script.

Hope you can help!

Accepted answer

0 additional answers

Your answer

Answer 1

Vasil Michev 119.8K MVP Volunteer Moderator

If you are new to the Graph, it can be a bit challenging, so it's probably best to use the Microsoft Graph SDK for PowerShell. Here's an example:

Select-MgProfile beta
Get-MgUser -Property signInActivity | select UserPrincipalName,@{n="LastSignIn";e={$_.signInActivity.LastSignInDateTime}} | ? {$_.LastSignIn -ge (Get-date).AddDays(-90)}

To do it directly via Graph, see for example: https://www.michev.info/Blog/Post/2968/reporting-on-users-last-logged-in-date-in-office-365
The query you can use to filter just sign ins in the past 90 days looks something like this:

https://graph.microsoft.com/beta/users?$filter=(signInActivity/lastsignindatetime+gt+2022-03-01T00:00:00Z)&$select=UserPrincipalName,signInActivity

Son 316

Thanks Michev for showing the way! We went with this in the end as we only need to target cloud only users:

Get-MgUser -All -Filter "OnPremisesSyncEnabled ne true" -CountVariable CountVar -ConsistencyLevel eventual -Property signInActivity |
    select UserPrincipalName,@{n="LastSignIn";e={$_.signInActivity.LastSignInDateTime}},@{n="NonInteractiveSignIn";e={$_.signInActivity.LastNonInteractiveSignInDateTime}} |
    ? {$_.LastSignIn -le (Get-date).AddDays(-30) -and $_.NonInteractiveSignIn -le (Get-date).AddDays(-30)}

EnterpriseArchitect 6,061 Reputation points

2023-04-17T15:43:06.1066667+00:00

@Vasil Michev , Does LastSignInDateTime is shown in UTC or Local Timezone ?

Share via

Using Microsoft Graph to find Inactive Azure AD Users

0 additional answers

Your answer