Blog Post

Microsoft Entra Blog
2 MIN READ

Review and remove AAD inactive users in Public Preview

Alex Simons (AZURE)'s avatar
Alex Simons (AZURE)
Icon for Microsoft rankMicrosoft
May 24, 2022

Howdy folks, 

 

I’m excited to share with you the public preview of access reviews for inactive users, part of Azure Active Directory Identity Governance. We have seen an explosion in collaboration growth over the past two years, both within and between organizations.  While this growth has been great for productivity, it’s also expanded the likelihood that “stale” accounts—accounts that were needed at one time, but not any longer—might be lurking in your environment.  Examples include former employees who have left the organization, or contractors whose assignments have ended.  It’s an easy but powerful way to reduce security risks by uncovering these stale accounts, and removing them if they truly have no purpose going forward.  

 

The public preview of access reviews for inactive users enables administrators to review and remove stale accounts that have not signed in for a certain number of days.  Both interactive and non-interactive sign-in activities are covered under sign-in activity.  As part of the review process, stale accounts can automatically be removed.  This, in turn, improves your organization’s security posture. 

 

Want to help reduce the risk of inactive users? Try the access reviews now. You can specify an inactive duration for up to two years for guest users, or all users.   

  

 

For detailed instructions on how to set up inactive user reviews, see our Azure AD access review documentation. To try these reviews out via our MS Graph APIs (beta), review our MS Graph API documentation.  

 

Best regards,  

Alex Simons (Twitter: @Alex_A_Simons) 

Corporate Vice President of Program Management 

Microsoft Identity Division 

 

 

Learn more about Microsoft identity: 

 

 

Updated May 19, 2022
Version 1.0
identity and access management
  • nhtkid's avatar
    nhtkid
    Iron Contributor
    May 25, 2022

    This is great, very useful.

    What about inactive devices? That feature coming soon?

  • helipetr2's avatar
    helipetr2
    Copper Contributor
    May 30, 2022

    Hi! We had a access review run with "inactive guests" and discovered that recently invited guests (still in pending state) are also counted as "inactive". So, we had many cases where guests were just invited (like today or the day before) and received access review requests. This happens because the last sign-in date of pending guests is empty, which can also be the case if guest hasn't been using the account since 2018. If I could choose, I'd filter out guests with pending state from the access review.

  • MikeCrowley's avatar
    MikeCrowley
    Iron Contributor
    May 24, 2022

    Great to see more targets coming to AAD Access Reviews!

     

    Edit - removed incorrect comment about the inability to review on-premises groups. :flushed:

  • dcober's avatar
    dcober
    Brass Contributor
    May 26, 2022

    Is there a way to target all inactive guest users in the tenant, rather than just those that are in M365 groups or teams? We have a lot of guest users in standalone SharePoint sites that are not connected to M365 groups.

  • Sijia_Zhu's avatar
    Sijia_Zhu
    Icon for Microsoft rankMicrosoft
    May 26, 2022

    dcober this feature works for M365 groups, security groups and applications. It does not work with SharePoint sites. 

  • ludoviclbit's avatar
    ludoviclbit
    Copper Contributor
    Jun 14, 2022

    As helipetr2 already mentioned, the inactive since X days feature in access reviews also flag very recently created accounts (in my case member accounts).
    It would be a real benefit of we were able to exclude the group members newer than Y days directly while configuring the inactive users access review.

    Thanks!

  • MikeCrowley's avatar
    MikeCrowley
    Iron Contributor
    May 25, 2022

    MaximeRastello Apologies, I stand corrected. In my head I combined the inability to include them in a catalog with the recommendation in the documentation to use cloud groups. I see now that I was wrong here.