🌟 How to Manage Inactive Guest Accounts in Microsoft 365 🌟

Recently, someone asked if it's possible to identify guest accounts that haven’t signed into a tenant recently and add them to a group. The target group could be a distribution list or a Microsoft 365 group. With the widespread use of guest accounts in Microsoft 365 for external sharing (think of Loop as the latest example adopting Entra ID B2B Collaboration), it’s inevitable that some guest accounts are no longer in use. Identifying and managing these inactive accounts isn’t just good housekeeping—it’s smart IT management. Why keep accounts that no longer serve a purpose? Here’s how you can take action: 1️⃣ Create a Target Group: Start by creating a distribution list or Microsoft 365 group where you’ll store the inactive guest accounts. You can do this in the Exchange or Microsoft 365 admin centers, or by running PowerShell commands like New-DistributionGroup (for a distribution list) or New-UnifiedGroup (for a Microsoft 365 group). 2️⃣ Update Membership Automatically: Once your group is ready, PowerShell is your best friend to automate membership updates. All you need is the group’s name, alias, or identifier to get started. 💡 Managing inactive accounts keeps your environment secure and organized. It’s a small effort for big results! How are you managing guest accounts in your tenant? step by step using powershell 👇

PowerShell Script

  

  
  


# Install the Exchange Online PowerShell module

Install-Module -Name ExchangeOnlineManagement -Force -AllowClobber
# Connect to Exchange Online using your administrator account

Connect-ExchangeOnline -UserPrincipalName ”Username@contso.onmicrosoft.com"
# Create a distribution group named "Inactive external Guests”

New-DistributionGroup -Name "Inactive external Guests" -Alias "InactiveexternalGuests" -Type Distribution -PrimarySmtpAddress "inactiveguests@varmlandska.onmicrosoft.com"

####promission Graph API

# Connect to Microsoft Graph API with extended permissions
Connect-MgGraph -Scopes "RoleAssignmentSchedule.ReadWrite.Directory", 
                 "Domain.Read.All", 
                 "Domain.ReadWrite.All", 
                 "Directory.Read.All", 
                 "Policy.ReadWrite.ConditionalAccess", 
                 "DeviceManagementApps.ReadWrite.All", 
                 "DeviceManagementConfiguration.ReadWrite.All", 
                 "DeviceManagementManagedDevices.ReadWrite.All", 
                 "openid", 
                 "profile", 
                 "email", 
                 "offline_access", 
                 "Policy.ReadWrite.PermissionGrant", 
                 "RoleManagement.ReadWrite.Directory", 
                 "Policy.ReadWrite.DeviceConfiguration", 
                 "DeviceLocalCredential.Read.All", 
                 "DeviceManagementManagedDevices.PrivilegedOperations.All", 
                 "DeviceManagementServiceConfig.ReadWrite.All", 
                 "Policy.Read.All", 
                 "DeviceManagementRBAC.ReadWrite.All"

############################################
# Retrieve all guest users with additional properties (for reporting or further processing)
$Guests = Get-MgUser -Filter "userType eq 'Guest'" -Property "displayName, userPrincipalName, signInActivity" -All -PageSize 500
# Format guest data as a custom object for output or export
$Guests | ForEach-Object { 
    [PSCustomObject]@{
        DisplayName = $_.DisplayName
        UserPrincipalName = $_.UserPrincipalName
        LastSignIn = $_.signInActivity.lastSignInDateTime
    }
}
# Set a date to filter users who have not signed in for over a month, or year, it’s upp to you
$CheckDate = (Get-Date).AddMonths(-1).ToString("yyyy-MM-ddTHH:mm:ssZ")
# Retrieve all guest users from Azure AD
$Guests = Get-MgUser -Filter "userType eq 'Guest'" -Property "signInActivity" -All -PageSize 500
# Filter guests who have not signed in since the specified date or have no sign-in activity
$InactiveGuests = $Guests | Where-Object { $_.signInActivity.lastSignInDateTime -lt $CheckDate -or $_.signInActivity -eq $null }
# Add each inactive guest to the "Inactive external Guests" distribution group
ForEach ($Guest in $InactiveGuests) {
    Add-DistributionGroupMember -Identity "Inactive external Guests" -Member $Guest.Id -ErrorAction SilentlyContinue
}
# Disconnect from Exchange Online
Disconnect-ExchangeOnline