During a recent engagement with a client, I was tasked with reviewing their Microsoft Entra ID tenant as part of a broader identity security assessment. One of my first observations was the presence of a significant number of inactive guest accounts.<\/p>\n\n\n\n
For context, guest accounts are typically assigned to external users invited to collaborate with an organization. In this case, many of these accounts were months\u2014or even years\u2014old and had either never signed in or had long since stopped accessing the tenant.<\/p>\n\n\n\n
This is a surprisingly common issue. Guest accounts are simple to create but often forgotten, and when left unmanaged, they present an unnecessary attack surface. Dormant accounts could potentially be compromised and exploited to gain access to internal resources.<\/p>\n\n\n\n
The client needed an efficient way to identify, review, and clean up these accounts\u2014without manually checking each one. In this write-up, I will outline how I approached this project and offer actionable strategies for managing inactive guest accounts in your own environment.<\/p>\n\n\n\n
The Approach<\/strong><\/p>\n\n\n\n Instead of performing a one-time manual cleanup, I created a reusable PowerShell script that connects to the tenant using the Microsoft Graph API and automates the entire process. Scripts like this not only save time but also ensure standardized implementation of such processes, allowing new team members to easily reuse the script in the future.<\/p>\n\n\n\n The script:<\/p>\n\n\n\n Using the dry run flag was crucial in this process. It allowed the client to first review a comprehensive report and verify that the list of guest users was correct. Only after confirming the accuracy of this list did we proceed to live mode, which executed the deletion of stale accounts.<\/p>\n\n\n\n Prerequisites<\/strong><\/p>\n\n\n\n To replicate this in your own environment you will need:<\/p>\n\n\n\n The Script<\/p>\n\n\n\n The full script is available on GitHub: github.com\/tmugema1\/stale-guest-user-cleanup<\/p>\n\n\n\n Here is the core logic:<\/p>\n\n\n\n # Get all guest users<\/em><\/p>\n\n\n\n $guestUsers = Get-MgUser -Filter “userType eq ‘Guest'” -All -Property “displayName,mail,userPrincipalName,createdDateTime,id”<\/em><\/p>\n\n\n\n # Check sign-in activity and flag stale users<\/em><\/p>\n\n\n\n $today = Get-Date<\/em><\/p>\n\n\n\n $staleUsers = foreach ($guest in $guestUsers) {<\/em><\/p>\n\n\n\n $signIns = Get-MgAuditLogSignIn -Filter “userId eq ‘$($guest.Id)'” -Top 1 | Select-Object -First 1<\/em><\/p>\n\n\n\n if ($signIns) {<\/em><\/p>\n\n\n\n $lastSignIn = $signIns.CreatedDateTime<\/em><\/p>\n\n\n\n $daysSinceSignIn = ($today – $lastSignIn).Days<\/em><\/p>\n\n\n\n } else {<\/em><\/p>\n\n\n\n $lastSignIn = “Never”<\/em><\/p>\n\n\n\n $daysSinceSignIn = 999<\/em><\/p>\n\n\n\n }<\/em><\/p>\n\n\n\n if ($daysSinceSignIn -ge $thresholdDays) {<\/em><\/p>\n\n\n\n [PSCustomObject]@{<\/em><\/p>\n\n\n\n Id = $guest.Id<\/em><\/p>\n\n\n\n DisplayName = $guest.DisplayName<\/em><\/p>\n\n\n\n Email = $guest.Mail<\/em><\/p>\n\n\n\n LastSignIn = $lastSignIn<\/em><\/p>\n\n\n\n DaysInactive = $daysSinceSignIn<\/em><\/p>\n\n\n\n }<\/em><\/p>\n\n\n\n }<\/em><\/p>\n\n\n\n }<\/em><\/p>\n\n\n\n The Output<\/p>\n\n\n\n The script exports a CSV report listing every stale guest account, their last sign-in date, and how many days they have been inactive. This gave the client a clear, auditable record of exactly who was removed and why. You could further customize the script to export the CSV file to a shared location such as SharePoint or OneDrive, automatically email it to an administrator. <\/p>\n\n\n\n What We Did Next<\/p>\n\n\n\n After the initial cleanup, I recommended the client put in place ongoing governance practices to prevent the problem from recurring. These include: <\/p>\n\n\n\n Conclusion<\/strong><\/p>\n\n\n\n Stale guest accounts pose a common yet often overlooked security risk for many organizations. Fortunately, with the right tools, identifying and cleaning up these accounts can be straightforward. Automating this process ensures that it does not get neglected over time.<\/p>\n\n\n\n A critical point to remember is that when automating with your script, you should always include a step to review the results before deleting any accounts. This reduces the already slim risk of accidentally removing active guest accounts that users may still rely on.<\/p>\n\n\n\n\n
\n
\n
\n