Find Inactive Users in Microsoft 365 using Microsoft 365 Admin Center

4.7K

There are generally two criteria to identify Microsoft 365 inactive users:

• The user account hasn’t signed in within a specified period.
• The user account had no recorded activities in Exchange Online, SharePoint Online, Yammer, Teams, and OneDrive, within a specified period.

Administrators can consider one or both criteria when analyzing inactive Microsoft 365 users for possible clean-up and freeing up of unused licenses.

The period by which the accounts are considered inactive is subjective. It could be the last 30 days, 90 days, etc. The organization or administrators must be the ones to nominate the optimal period of inactivity.

Understanding Last Sign-in Properties

Microsoft Entra records several different sign-in timestamps:

• Last interactive sign-in — the last time a user signed in interactively (browser, desktop app, MFA).
• Last non-interactive sign-in — authentication performed by background services, refresh tokens, or apps.
• Last successful sign-in — the last successful authentication regardless of sign-in type.

Depending on your licensing and reporting requirements, these timestamps may provide a more accurate picture of actual user activity.

Find Inactive Users in Microsoft Entra Admin Center by Sign-In Activity

The Microsoft Entra admin center (formerly Azure Active Directory Admin Center) provides a user-friendly interface to manage user accounts and activities. The Microsoft Entra admin center currently exposes the Last sign-in time column in the Users view. If your tenant also exposes Last successful sign-in, prefer using it because it more accurately reflects successful authentication. To find inactive users based on their last successful sign-in date, follow these steps:

1. Log in to Microsoft Entra and navigate to Identity → Users → All Users.
   

   

2. Click Manage view → Edit columns.
   

   

3. Customize the columns and ensure that either Last successful sign-in (preferred) or Last sign-in time is visible. Then click Save.
   

   

4. Click Add filter and select Last successful sign-in if available; otherwise use Last sign-in time.
   

   

5. Change the Operator to “<=” (less than or equal to), specify the Value (date) threshold, and click Apply. This filter only shows accounts that last signed in on or before the selected date.
   

   

6. You now have a list of inactive Microsoft 365 users who have not signed in to their accounts within the previous number of days. Click “Download users”, enter the filename to generate the Microsoft 365 inactive users report CSV file, and click Start.
   

   

7. Click the “Bulk operation results” menu blade and select the report from the list. Note that the status should be “Completed” before downloading the report.
   

   

8. Click the “Download results” link, specify the filename and location, and click Save.
   

   

   You’ve now downloaded the Microsoft 365 Inactive users report.
   

   

Depending on your Microsoft Entra tenant and licensing, additional sign-in properties (such as Last successful sign-in and Last non-interactive sign-in) may also be available. These values often provide a more accurate representation of user activity than the legacy Last sign-in time field.

Note that access to detailed sign-in activity requires Microsoft Entra ID P1/P2 licensing. Keep in mind that available sign-in properties may vary depending on your tenant license.

Before you proceed with this method, follow the “Microsoft 365 reports show anonymous user names instead of actual user names” instructions to ensure that the Microsoft 365 report shows the user names.

Find Inactive Users in Microsoft 365 using Microsoft 365 Admin Center by the Last Activity Date

Like the previous method, you can find inactive users based on their last activity date. The data can be found in the usage reports. Here’s how:

1. Log in to the Microsoft 365 Admin Center.
2. Navigate to Reports → Usage → Microsoft 365 apps → Active Users. Select the reporting period, such as “Past 90 days”. Doing so will show the activity logs in the past 90 days.
   

   

3. Here you can find out which users have licenses assigned but had no activities within the specified reporting period.
   

   

4. You can also export this report by clicking the Export button and downloading the resulting CSV file.

Generate Microsoft 365 Inactive Users Report using Microsoft Graph PowerShell by the Last Successful Sign-In

For those who prefer a more automated approach, Microsoft Graph PowerShell can be a powerful tool. This method lets you generate detailed reports on inactive users based on their last successful sign-in. Here’s how:

1. First, copy the script below and save it to your computer as Get-InactiveUsersByLastSuccessfulSignIn.ps1. You can also download the code from this link.

   # Get-InactiveUsersByLastSuccessfulSignIn.ps1 
   [CmdletBinding()] 
   param ( 
   [Parameter(Mandatory)] 
   [int] 
   $DaysWithoutSuccessfulSignIn 
   ) 
   
   # Convert the date to datetimeoffset "yyyy-MM-ddThh:mm:ssZ" format. 
   $OnOrBefore = ((Get-Date).AddDays(-$DaysWithoutSuccessfulSignIn)).ToString("yyyy-MM-ddT00:00:00Z") 
   
   # Compose the API filter
   $filter = ('signInActivity/LastSuccessfulSignInDateTime le ' + $OnOrBefore) 
   try { 
   
   # Import the required module 
   Import-Module Microsoft.Graph.Users 
   
   # Get users and 
   Get-MgUser -All -Filter $filter -ErrorAction Stop -Property ` 
   'DisplayName', 'UserPrincipalName', 'Mail', 'UserType', 'AccountEnabled', 'SignInActivity' | 
   Select-Object 'DisplayName', 'UserPrincipalName', 'Mail', 'UserType', 'AccountEnabled', 
   @{n='LastSuccessfulSignInDate';e={ 
   $( 
   if (!$_.SignInActivity.LastSuccessfulSignInDateTime) { 
   
   # Users who have never signed in are assigned the minimum DateTime value. 
   [datetime]::MinValue 
   } 
   else { 
   $_.SignInActivity.LastSuccessfulSignInDateTime 
   } 
   ) 
   } 
   }, 
   @{n='DaysWithoutSuccessfulSignIn'; e = { 
   $( 
   if (!$_.SignInActivity.LastSuccessfulSignInDateTime) { 
   
   # Users who have never signed in are assigned the minimum DateTime value. 
   (New-TimeSpan -Start ([datetime]::MinValue)).Days 
   } 
   else { 
   (New-TimeSpan -Start ($_.SignInActivity.LastSuccessfulSignInDateTime)).Days 
   } 
   ) 
   } 
   } 
   } 
   catch { 
   $_.Exception.Message | Out-Default 
   return $null 
   }

2. Open PowerShell and change the working directory to where you saved the script.

   Set-Location <script location>

3. Run the following command to connect to Microsoft Graph. This connection explicitly requests the AuditLog.Read.All and User.Read.All API permissions.

   Import-Module Microsoft.Graph.Authentication
   
   Connect-MgGraph -Scopes "AuditLog.Read.All","User.Read.All"

4. Click “Accept” to consent to the requested permissions.
   
5. Execute the script as shown below. Adjust the -DaysWithoutSuccessfulSignIn value as needed.

   .\Get-InactiveUsersByLastSuccessfulSignIn.ps1 `
   -DaysWithoutSuccessfulSignIn 30 |
   Sort-Object DaysWithoutSuccessfulSignIn -Descending

   This example finds Microsoft 365 users whose last successful sign-in occurred more than 30 days ago.
   You can also export the results to a CSV file by piping it to the Export-Csv cmdlet.

   .\Get-InactiveUsersByLastSuccessfulSignIn.ps1 -DaysWithoutSuccessfulSignIn 30 | Export-Csv <csv file> -NoTypeInformation

This method requires the latest Microsoft Graph PowerShell SDK. You need to install/update the Microsoft.Graph module before running the script. Refer to this Microsoft Document.

Generate Microsoft 365 Inactive Users Report using Microsoft Graph PowerShell by the Last Activity Date

Similar to the previous method, you can generate an inactive Microsoft 365 users report based on the last activity date.

Users assigned licenses, such as Exchange, SharePoint, Teams, OneDrive for Business, and Yammer, are expected to use those services. If not, it would be best to know who isn’t using their Microsoft 365 services.

1. Copy the script below and save it to your computer with the filename Get-InactiveUsersByLastActivityDate.ps1. You can also download the script from this link.
   

   #Get-InactiveUsersByLastActivityDate.ps1
   [CmdletBinding()]
   param (
   [Parameter(Mandatory)]
   [int]
   $DaysWithoutActivity
   )
   try {
   Import-Module Microsoft.Graph.Reports 
   $tempCsv = "$env:temp\tmp_office365users.csv" 
   Get-MgReportOffice365ActiveUserDetail -Period D180 -OutFile $tempCsv -ErrorAction Stop -WarningAction SilentlyContinue 
   $data = Import-Csv -Path $tempCsv 
   } 
   catch { 
   $_.Exception.Message | Out-Default 
   return $null 
   } 
   try { 
   $data | ForEach-Object { 
   [System.Collections.ArrayList]$inactiveDays = @() 
   if ($_.'Has Exchange License' -eq 'TRUE') { 
   if ($_.'Exchange Last Activity Date') { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'Exchange Last Activity Date')).Days)) 
   } 
   else { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'Exchange License Assign Date')).Days)) 
   } 
   } 
   else { $null = $inactiveDays.Add(0) } 
   if ($_.'Has SharePoint License' -eq 'TRUE') { 
   if ($_.'SharePoint Last Activity Date') { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'SharePoint Last Activity Date')).Days)) 
   } 
   else { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'SharePoint License Assign Date')).Days)) 
   } 
   } 
   else { $null = $inactiveDays.Add(0) } 
   if ($_.'Has OneDrive License' -eq 'TRUE') { 
   if ($_.'OneDrive Last Activity Date') { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'OneDrive Last Activity Date')).Days)) 
   } 
   else { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'OneDrive License Assign Date')).Days)) 
   } 
   } 
   else { $null = $inactiveDays.Add(0) } 
   if ($_.'Has Teams License' -eq 'TRUE') { 
   if ($_.'Teams Last Activity Date') { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'Teams Last Activity Date')).Days)) 
   } 
   else { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'Teams License Assign Date')).Days)) 
   } 
   } 
   else { $null = $inactiveDays.Add(0) } 
   if ($_.'Has Yammer License' -eq 'TRUE') { 
   if ($_.'Yammer Last Activity Date') { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'Yammer Last Activity Date')).Days)) 
   } 
   else { 
   $null = $inactiveDays.Add($((New-TimeSpan -Start (Get-Date $_.'Yammer License Assign Date')).Days)) 
   } 
   } 
   else { $null = $inactiveDays.Add(0) } 
   $DaysInactive = ($inactiveDays | Sort-Object)[0] 
   # $DaysInactive | Out-Default 
   if ($DaysInactive -ge $DaysWithoutActivity) { 
   [PSCustomObject]@{ 
   Name = $_.'Display Name' 
   Username = $_.'User Principal Name' 
   DaysWithoutActivity = $DaysInactive 
   } 
   } 
   } 
   } 
   catch { 
   $_.Exception.Message | Out-Default 
   }

2. Open PowerShell and change the working directory to where you saved the script.
   

   Set-Location <script location>

3. Run the following command to connect to Microsoft Graph. This connection explicitly requests the Reports.Read.All API permission.
   

   Import-Module Microsoft.Graph.Authentication 
   
   Connect-MgGraph -Scopes "Reports.Read.All" -TenantId <tenant ID>

4. Click “Accept” to consent to the requested permissions.
   Note. Older Microsoft Graph PowerShell examples often use the Microsoft.Graph.Beta modules because the SignInActivity property was originally available only through Microsoft Graph Beta. Current Microsoft Graph SDK releases expose this functionality through the stable modules in most environments, so you should use Microsoft.Graph unless a specific feature still requires the Beta SDK.
5. Execute the script as shown below. Adjust the -DaysWithoutActivity value as needed.
   

   .\Get-InactiveUsersByLastActivityDate.ps1 -DaysWithoutActivity 30

   

   This example will find inactive users in Microsoft 365 whose last activity in Exchange, Teams, OneDrive, SharePoint, and Yammer is beyond the past 30 days.You can also export the results to a CSV file by piping it to the Export-Csv cmdlet.

   .\Get-InactiveUsersByLastActivityDate.ps1 -DaysWithoutActivity 30 | Export-Csv <csv file> -NoTypeInformation