{"id":3790,"date":"2021-12-16T15:57:32","date_gmt":"2021-12-16T14:57:32","guid":{"rendered":"https:\/\/www.lieben.nu\/liebensraum\/?p=3790"},"modified":"2021-12-16T15:57:32","modified_gmt":"2021-12-16T14:57:32","slug":"guest-user-last-sign-in-date-time-in-azure-active-directory-and-automatic-cleanup","status":"publish","type":"post","link":"https:\/\/lieben.nu\/liebensraum\/2021\/12\/guest-user-last-sign-in-date-time-in-azure-active-directory-and-automatic-cleanup\/","title":{"rendered":"Guest User Last Sign-in date time in Azure Active Directory and automatic cleanup"},"content":{"rendered":"\n
\"\"<\/a><\/figure>\n\n\n\n

Azure AD’s sign in logs also only go back 30 days, which makes it highly recommended to stream Azure AD’s sign in logs to a Log Analytics workspace<\/a> (Azure Monitor). You just need one single P1 license in your tenant to be able to enable this.<\/p>\n\n\n\n

However, even if you don’t stream your sign in logs, Microsoft does keep track of when an account last signed in.<\/a><\/p>\n\n\n\n

My script gets the last sign in data of all guest accounts in your tenant, without any dependencies other than the Az PS module.<\/p>\n\n\n\n

If a guest user has never signed in, the creationDate is used to determine inactivity. Otherwise either the last interactive or last non interactive sign in is used (whichever is most recent).<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Additionally, the script can also be configured to automatically clean up any guest accounts that have been inactive<\/strong> for a given number of days by using the -removeInactiveGuests switch.<\/p>\n\n\n\n

Even in large environments, processing only takes a few minutes at most.<\/p>\n\n\n\n

Download<\/strong><\/p>\n\n\n\n

Download the script from my Gitlab here:<\/p>\n\n\n\n

https:\/\/gitlab.com\/Lieben\/assortedFunctions\/-\/blob\/master\/get-AzureAdInactiveGuestUsers.ps1<\/a><\/p>\n\n\n\n

Limitations<\/strong><\/p>\n\n\n\n

Microsoft started using these properties in april 2020, so accounts active before that will seem like they have never been active.<\/p>\n\n\n\n

Scheduling<\/strong><\/p>\n\n\n\n

This script supports running non-interactive as a runbook in Azure Automation if you supply the -nonInteractive switch. Before this will work, you’ll have to enable Managed Identity on your automation account and run a small script to assign graph permissions to the Managed Identity<\/a>: AuditLog.Read.All and Organization.Read.All and if you also want it to be able to execute deletions: User.ReadWrite.All<\/code> and assign the MI the ‘Privileged Authentication Administrator’ role in Entra.<\/a><\/p>\n\n\n\n

Reports<\/strong><\/p>\n\n\n\n

If you wish, you can also let the script mail you a report in CSV format. Add the Mail.Send graph permissions like you did with device permissions and give the MailFrom and MailTo parameters a value.<\/p>\n\n\n\n

Disclaimer<\/strong><\/p>\n\n\n\n

As always this script is provided as-is and should be reviewed and then used at your own risk.<\/p>\n","protected":false},"excerpt":{"rendered":"

Azure AD’s sign in logs also only go back 30 days, which makes it highly recommended to stream Azure AD’s sign in logs to a Log Analytics workspace (Azure Monitor). You just need one single P1 license in your tenant to be able to enable this. However, even if you don’t stream your sign in … Continue reading Guest User Last Sign-in date time in Azure Active Directory and automatic cleanup<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[4,7,21,32,39,43],"tags":[],"class_list":["post-3790","post","type-post","status-publish","format-standard","hentry","category-automation","category-azuread","category-identity","category-office-365","category-powershell","category-security"],"_links":{"self":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/3790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/comments?post=3790"}],"version-history":[{"count":0,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/3790\/revisions"}],"wp:attachment":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/media?parent=3790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/categories?post=3790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/tags?post=3790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}