A graphical interface script to help stay in control of guest access in Entra ID. The tool helps identify disabled, inactive and never-used guest users.
A graphical interface displays the results.
The "save"-icon lets you save results to CSV (for bulk-operations in Entra ID?) To inspect the results, click the "list"-icons in GUI. If you have a selection when clicking "OK", the users UPN is copied to clipboard for bulk delete/disable operations.
The script is read-only and will not disable or delete any users.
Errors and some info is outputed to console when running.
- A registered app with the
User Read AllandAuditLog.Read.AllGraph permissions See this step-by-step guide
Install-Script -Name InactiveWipe
Running the script
.\InactiveWipe.ps1 -TenantId <your-tenant-id> -AppId <your-app-id> -AppSecret <your-app-secret>| Parameter | Description |
|---|---|
| TenantId (mandatory) | Your Entra ID tenant ID 'string' |
| AppId (mandatory) | The application ID for your registered application in Azure AD 'string' |
| AppSecret (mandatory) | The client secret for your registered application |
| ThresholdDaysAgo | Number of days without activity for guests to be consideres inactive. Default is 180 days 'int' |
- Before removing disabled users, check their last sign-in activity first
- Before removing users that have never signed in, make sure they where not recently invited/added (createdDateTime)
- Don't store ClientSecret/Application Secret in script. Ideally, load it from a password manager, SecretStore or alike. If not, at least close process and clear command history
If you are not familiar with PowerShell to perform batch operations like remove and disable/block of users in Entra ID, you can use bulk operations in the Entra AD portal.
- Use the tool to identify and select users for removal (UPN copied to clipboard when clicking ok from gridview)
- Go to User blade in Entra AD portal
- Select "Bulk operations" and "Bulk delete"
- Download example CSV
- Open the example CSV, paste guest-users UPN, save the file
- Upload the file to "bulk delete users" and type "Yes" to contine.
- Click "Submit"