Inactive users are those who haven't logged into Microsoft 365 for a particular period! These users present potential security risks and can consume unnecessary resources in your organization. We are here to provide step-by-step instructions to export inactive user report in Microsoft 365 and outline strategies to safeguard your organization.
Windows PowerShell Get-MgUser -UserId <UserId> -Property SigninActivity | select -ExpandProperty SigninActivity 
This M365 Inactive User Management Report Collection ReportBoard is specifically designed to highlight key information about inactive accounts across various Microsoft 365 services.
Thus, you can quickly identify inactive users and revoke unused licenses within your organization.
The AdminDroid’s Microsoft 365 analytics tool offers a comprehensive suite of reports, enabling admins to promptly identify and manage inactive users. Beyond just reporting, it incorporates various enhancement features to streamline and optimize the Microsoft 365 inactive user reporting.
AdminDroid’s Azure AD auditing package helps to track activities, including logins, password updates, etc., to efficiently track the inactive users in the organization.
Use AdminDroid’s Microsoft 365 email monitoring tool to audit email traffic, including spam and malware, helping to identify vulnerable inactive users in Exchange Online.
Monitor the malicious file activities through the inactive user accounts and revoke the sensitive data permissions assigned with the help of AdminDroid’s SharePoint Online auditing tool.
Regularly audit the Exchange Online mailbox activities reports to find and manage the inactive mailboxes in the Microsoft 365 environment.
Detect suspicious and unauthorized logins from unfamiliar locations using inactive user accounts with the help of AdminDroid’s Microsoft 365 sign-in analytics.
AdminDroid’s Microsoft Teams auditing tool provides comprehensive metrics on Teams operations, such as Teams logins, file accesses, and membership activities to find inactive Teams users.
Therefore, the AdminDroid Microsoft 365 reporting and auditing tool acts as a crucial alert mechanism for identifying inactive users and spotlighting any unusual or suspicious activities that might cause potential security risks in the Microsoft 365 environment.
These questions arise as the Get-MailboxStatistics cmdlet with the LastLogonTime parameter returned inaccurate results. This is because the parameter also includes mailbox assistant activity in Exchange Online, which is running in the background.
((Get-MgBetaUser -UserId <UserId> -Property SigninActivity).SignInActivity.AdditionalProperties).lastSuccessfulSignInDateTime If you have set the execution policy settings to ‘RemoteSigned’, the above error will occur while running the PowerShell script.
Set-ExecutionPolicy -Scope Process -ExecutionPolicy BypassThis error occurs when the MS Graph module does not have permission to read the audit log to display the last active time of users.
Connect-MgGraph –Scopes Directory.Read.All,AuditLog.Read.AllThis error occurs when you send an email to an inactive user without an Exchange Online license in your organization.
This error message occurs when you try to run the PowerShell cmdlets without the connecting Microsoft Graph PowerShell.
Install-Module Microsoft.Graph -Scope CurrentUserConnect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All"
Inactive users in Microsoft 365 can indeed pose various security risks. If an inactive user’s account is compromised, it can be used to send phishing emails or launch other types of attacks. Below are a few cases that lead to severe security damage in your organization.
Thus, properly managing and regularly auditing inactive Microsoft 365 users are crucial steps in mitigating the above risks and ensuring a secure and compliant IT environment.
AdminDroid enables efficient user management in your organization across various Microsoft services:
Auditing user activity in Microsoft 365 can be accomplished through various methods. Below are the most widely used methods, each providing different levels of detail and data.
However, some details like operation status for specific workloads, number of inactive days, license activities, etc., need PowerShell coding to access detailed information.
Utilize the Search-UnifiedAuditLog cmdlet to search the unified audit log.
Search-UnifiedAuditLog -Startdate "mm-dd-yyyy" -Enddate "mm-dd-yyyy" -UserIds <UPN> These logs include events from Office 365 workloads such as Exchange Online, SharePoint Online, Azure Active Directory, OneDrive for Business, Microsoft Teams, and more.
Note: To retrieve complete user activities in the audit log search, make sure to enable Microsoft 365 unified audit logs.
Unfortunately, the last logon time reported by this cmdlet may not always be accurate.
However, these logs are limited to the last 30 days, which may not be sufficient for a comprehensive view of user activity.
With AdminDroid, you can completely audit Entra ID activities, such as user logins, password changes, Azure AD applications' activities, and so on to prevent anonymous access to any inactive user accounts in Microsoft 365.
Since the Azure AD cmdlets are in deprecation, with the help of the Get-MgUser cmdlet, you can retrieve the last logon time of a specific Microsoft 365 user to find user inactivity.
Get-MgUser -Userid <Userid> -Property SigninActivity | select -ExpandProperty SigninActivityThis cmdlet provides the specific user's last logon time but doesn't offer in-depth details like a list of all inactive users with assigned licenses, inactive users based on interactive and non-interactive sign-ins, users’ inactive days across all services, etc.
Thus, with the help of the provided ‘GetM365InactiveUserReport’ PowerShell script, you can generate 10+ Office 365 last logon reports to manage inactive users in your Microsoft 365 organization.
Also, the script supports built-in filters. So, you can combine multiple filters to get more granular reports.
Each of these use cases provides different insights into user activity and inactivity, making it easier to manage inactive users in your organization. But remember, regular auditing and reporting are key to maintaining a secure and efficient Microsoft 365 environment.
In addition to the above, overlooking inactive mailboxes in Microsoft 365 can expose your organization to serious security risks, compliance issues, and unnecessary expenditures on licenses. Our comprehensive guide provides efficient methods to identify inactive mailboxes in Exchange Online within Microsoft 365.
Here is a quick glimpse!
You can pinpoint guest user inactivity in a more specific manner within your Microsoft 365 organization. Identify stale guest accounts using the inactive guest reports by following these steps:
In this section, you'll find a list of users who have been inactive for the past 90 days by default. However, you have the flexibility to adjust the inactivity threshold as per your organization's needs. This report provides:
With this report, you can monitor inactive guest accounts and make informed decisions to delete them in Microsoft 365. Regular monitoring of this report ensures that inactive guest users are removed monthly, enhancing Microsoft 365 security.
Additionally, You will be able to create Microsoft Entra ID Governance access reviews to manage inactive guests. You can opt for a single-stage or multi-stage access review, depending on your organizational needs.
However, one limitation is that you need the Microsoft Entra ID Governance license to access this report.
For a more effective and precise method of retrieving inactive users in Microsoft 365, particularly in larger environments, consider using AdminDroid’s Inactive Users Reports Collection.
Key features of AdminDroid that make monitoring inactive users more efficient include:
These features make AdminDroid an essential tool for managing inactive users in Microsoft 365 organizations.
To delete inactive Office 365 users and remove their licenses, you can follow the steps below:
Deleting a user account frees up their license, allowing you to reassign it to another employee or remove it entirely.
Note: You have a 30-day grace period from the date of deletion to restore the account if necessary. After 30 days, the data associated with the account is permanently deleted.
The below cmdlet will delete a Microsoft 365 user and automatically revoke the license associated with a removed account.
Remove-MgUser -UserId 'user@contoso.com' -Confirm
#It prompts for admin confirmation before deleting the user account.
Using PowerShell is particularly effective for managing licenses in bulk or automating the process, while the Microsoft 365 admin center provides a more user-friendly interface for handling individual accounts.
Note: Ensure you have the necessary administrative permissions before proceeding with these operations.
Get AdminDroid Office 365 Reporter Now!