Connect to your tenant

Sign in with the account you manage the tenant with. The tool reads guest users and their sign-in activity through Microsoft Graph, as you.

Delegated permissions asked at sign-in:

  • User.Read.All list guest users and the recycle bin
  • AuditLog.Read.All last sign-in per guest

Asked only when you first disable, delete or restore: User.ReadWrite.All. You also need the User Administrator role or higher, otherwise Graph answers 403.

Recently deleted guests

Entra keeps deleted users for 30 days. After that they are gone for good.

About InactiveGuests

InactiveGuests shows the dormant guest accounts in your Entra ID tenant so you can disable, delete or restore them in bulk.

What it does

  • Lists every guest with creation date, redemption state, enabled state and last sign-in (interactive and non-interactive).
  • Filters on inactivity, account age, redemption state, enabled state and "never signed in".
  • Disables, enables or deletes the selection after showing you exactly who is affected.
  • Exports the filtered list to Excel or CSV.
  • Restores guests from the recycle bin within the 30 day window.

How it works

  • Listing: GET /beta/users?$filter=userType eq 'Guest'&$select=...,signInActivity. signInActivity is reliable on beta only.
  • Inactivity: the most recent of lastSignInDateTime and lastNonInteractiveSignInDateTime. No sign-in at all falls back to createdDateTime, so a guest invited yesterday is not "inactive forever".
  • Disable and enable: PATCH /v1.0/users/{id} with accountEnabled.
  • Delete: DELETE /v1.0/users/{id}. The user stays restorable for 30 days.
  • Restore: POST /v1.0/directory/deletedItems/{id}/restore.

Sign-in activity caveat

signInActivity needs an Entra ID P1 or P2 licence in the tenant. Without it the field stays empty and inactivity is based on account age, which makes "never signed in" match everyone.