How to Find Inactive Users in Microsoft Teams

Reviewing sign-in logs in Microsoft Teams helps to identify inactive users who have not signed in for an extended period. It also highlights failed sign-in attempts by those users. This helps you investigate the cause, analyze inactivity patterns, address potential security risks, and ensure proper access management.

• Log in to the Microsoft Entra admin center and navigate to Sign-in logs under Identify»Monitoring & health.
• In the 'Add filters' option, choose Application, and click Apply.
• Enter the application name 'Microsoft Teams' in the selected filter and click Apply to view all user login activities in MS Teams.

Note: Filter the logs by date range and specific user to find their last sign-in time from the first entry. By default, the logs show data for the last 24 hours, but you can customize the date range up to 30 days.

Connect to the Microsoft Graph PowerShell module using the cmdlet below.

Connect–MgGraph –Scopes "AuditLog.Read.All"

Run the following cmdlet in PowerShell to export Microsoft Teams login activities.

Get-MgAuditLogSignIn -Filter "startsWith(appDisplayName,'Microsoft Teams')" -All | Select-Object CreatedDateTime, UserDisplayName, UserPrincipalName, IPAddress, AppDisplayName | Export-Csv -Path <FilePath>

• The Teams login activities report lists user's login history in MS Teams along with details, such as logged-in time, logged-in user, result status, client info, IP address, and more.
• These logs can be reviewed to investigate suspicious logins and unauthorized access attempts.

Handy tip: Utilize the Export capability to download the Microsoft Teams sign-in logs report in various formats like CSV, PDF, and HTML for further analysis.

Manual tracking of inactive users is time-consuming, error-prone, and does not allow you to identify inactive users within specific teams. Microsoft Entra access reviews automate inactive user detection from specific group, notifies reviewers, and enforces access removal upon approval.

Note: Finding inactive users in Teams or groups using Access Reviews requires a Microsoft Entra ID Governance license.

To find inactive accounts in Microsoft Teams using Access Reviews, navigate to Identity Governance»Access Reviews in the Entra portal and follow the steps below.

• Click "+ New Access review" and choose Teams + Groups under Select what to review.
• Set the Review scope to Select Teams + Groups, then click "+ Select group(s)", and choose the teams you want to review. In the Scope, select All users.
• Select Inactive users only and specify the number of inactive days. Then, click Next: Reviews.

• Select Multi-stage review for multiple reviews of inactive users. Leave it unset for a single-stage review.
• In the 'Specify reviewers' section, select who will evaluate inactive users.
• Under Specify recurrence of review section, specify the duration (in days), required Review recurrence and Start date.
• Then, select 'End after number of occurrences' for End section and set the required number of 'Occurences'. Then, click Next: Settings.

Note: If you select Group owner(s) or Managers of users as primary reviewers, you can set Fallback reviewers to handle reviews when a group has no assigned owner or a user has no assigned manager.

• Configure the additional settings based on your requirements and click Next: Review + Create.
• Give the access review a name, add a description, and click Create to finalize the review setup.
• Once the review is set up, reviewers receive email notifications to evaluate inactive users.

Reviewers can approve, remove, or request additional details about user access. After review completion, Microsoft Entra enforces decisions based on the configured settings.

Identifying inactive users in teams is only the first step. The crucial part is to remove them to prevent unauthorized access and optimize license usage. Since teams are linked to Microsoft 365 groups, removing a user from a team also results in their removal from the associated M365 group.

• Log in to the Microsoft Teams admin center and navigate to Teams»Manage teams.
• Click on the respective team to find the team membership of inactive users.
• In the Members tab, find the inactive user in the list, select their name, and click Remove to revoke their access from the team.

While the Microsoft Teams admin center allows you to remove inactive users, manually reviewing each team is time-consuming. PowerShell offers a more efficient approach by allowing you to quickly identify and remove inactive users across all teams.

Connect to the Microsoft Teams PowerShell module using the cmdlet below.

Connect-MicrosoftTeams

Run the following PowerShell snippet to remove inactive users from teams in Microsoft 365 by replacing <User1> and <User2> with the list of inactive users' UPNs.

$users = @("<User1>", "<User2>") 
	foreach ($User in $Users) { 
		$teams = Get-Team -User $User | Select-Object -ExpandProperty GroupId 
		foreach ($Team in $Teams) { Remove-TeamUser -GroupId $Team -User $User } 
}

The above snippet identifies the team membership of listed users and removes them from their respective teams.

• With members removed from teams report, you can audit all teams member removals in Microsoft Teams.
• This report helps you identify who removed the user from the team and check if they were inactive with details such as removed time, team name, removed members, and more insights.

Inactive users in MS Teams pose security risks if their sign-in or data access is not revoked. Disabling Teams prevents them from accessing sensitive data. While the core Teams license is bundled with Microsoft 365, removing add-ons like Teams Premium, Audio Conferencing, Teams Phone Standard, and more helps optimize costs by eliminating unnecessary expenses.

• Navigate to the Active users page in the Microsoft 365 admin center.
• Search for the inactive user and click their name.
• Go to the Licenses and apps tab.
• In the Apps section, uncheck the Microsoft Teams product license to disable Microsoft Teams access to that specific user, then click Save changes.

Connect to the Microsoft Graph PowerShell module using the cmdlet below.

Connect-MgGraph -Scopes "Organization.Read.All", "LicenseAssignment.ReadWrite.All", "User.ReadWrite.All" 

Run the below PowerShell cmdlet to find the SkuPartNumber or SkuID of the enterprise subscription that contains Teams license or to identify a Teams add-on license.

Get-MgSubscribedSku –All | Format-List

Then, run the following PowerShell snippet to remove a Microsoft Teams license from an inactive user by replacing <SkuPartNumber> and <UserUPN> with the correct values.

$Subscription = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq '<SkuPartNumber>' 
$DisabledPlans = $Subscription.ServicePlans | Where-Object ServicePlanName -eq 'TEAMS1' | Select-Object -ExpandProperty ServicePlanId 
$AddLicenses = @( @{ SkuId = $Subscription.SkuId;  DisabledPlans = $DisabledPlans } ) 
Set-MgUserLicense -UserId "<UserUPN>" -AddLicenses $AddLicenses -RemoveLicenses @()

To remove the Teams add-on license from an inactive user in Microsoft 365, run the below PowerShell cmdlet.

Set-MgUserLicense -UserId "<UserUPN>" -RemoveLicenses @("<SkuId>") -AddLicenses @{}

Removing Teams add-on licenses for inactive users reduces unnecessary costs, but it does not remove their access to other Microsoft 365 services. To fully restrict access, consider disabling sign-ins or removing licenses at the tenant level.