Guest Users - Clean Up

Use the Access Reviews feature: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-azure-ad-controls-access-reviews-overview

If you don't like the fact that it requires AAD P2 license, you can write your own workflow that uses the same principle :)

+1 on the proposed 'Access Reviews' solution. 

Using the info from the responses, I've looked into Access Reviews, and found it to be a really good way to meet these needs. 

I created a review, set the schedule/interview, specified Guest Users only, and saw all of the other options that are available to be set, including who to notify for re-attestation (.the guest users themselves, owners of a designated group who are responsible for managing a given set of guest users <which can be a dynamic security group based on an attribute populated for different sets of guest users>, a designated 'guest user manager(s)', and others).

Probably the best option was the fact that it had a 'what action to take if user doesn't respond to the access review.'  Haven't validated this yet but one option was to revoke access, which our Infosec dept will love.  

We're an E5 org, but don't have AAD P2.  We have P1 with one of those custom-bundle license packages.  I've added a P2 trial, but don't know what it will necessarily give us with our needs in this dept.  Our MS Acct Mgrs are willing to work with us given the FY Close in June, so if someone in the know could provide me some info about the enhancements/value-add of P2 in the Access Review, Cloud App Discovery, and anything else that I can use to enhance security in Azure/O365 I'd appreciate it.  

I realize this is an older thread, but replying for the benefit of those who may come later. I had a similar requirement, except that we needed to allow a 6 month window before declaring a guest account as stale/dormant. After some searching I was able to put together pieces from other posts I found to create a PowerShell script that uses the MS Graph api which will generate a report of the guest accounts, their creation date, and last login date. You can then use Excel to query the results according to what ever criteria you might need to use.

Note: it assumes the Graph PowerShell module has already been installed.

***********************************************************************************************

Connect-MgGraph -Scopes "User.Read.All","Group.ReadWrite.All","AuditLog.Read.All"
Select-MgProfile beta

$usertype = "Guest" #Enter Guest or Member

$Result=@()
$usersUPN = Get-MgUser -All -Filter "UserType eq '$usertype'" | Select UserPrincipalName, ID, DisplayName, CreatedDateTime
foreach($user in $usersUPN)
{
$usersignindate = Get-MgUser -UserId $user.ID -Select SignInActivity | Select -ExpandProperty SignInActivity
$userprops = [ordered]@{
UserPrincipalName = $user.UserPrincipalName
DisplayName = $user.DisplayName
LastSignInDateTime = $usersignindate.LastSignInDateTime
CreatedDateTime = $user.CreatedDateTime
}
$userObj = new-object -Type PSObject -Property $userprops
$Result += $userObj
}
$Result |select *|export-csv c:\scripts\userlastlogin.csv