Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community
SOLVED

Cleanup stale guests

Brass Contributor

Hi, we have Entra ID p2 licenses, however cannot select the option "Inactive Users (On Tenant Level) only" in the access review. Wherefore i cannot specify the timeframe after which guests account are deemed inactive.

 

To circumvent this i wrote a script, which connects to Microsoft Graph with a registered app. This to list and remove guest accounts within their proper time frames. I wanted the run the script with an automation account (PowerShell Runbook), however the script does not recognize the Microsoft.graph commands, even though both modules have been installed (Microsoft.graph.users and Microsoft.Graph.Beta.users). Also the 2 modules are explicitly imported at the start of the PowerShell script.

 

The script works when i run it from a computer, so the script is valid. But also onprem i bump into a strange issue. I created a scheduled task to run the script from an OnPrem Server, when i run the scheduled task under my account, then the script works as expected, however when i run the task under a single managed service account, then the script runs but fail to retrieve any guests users from the tenant. Script logging shows that the script successfully connects to the tenant as the registered application, but does not retrieve any guest accounts. This cannot be related to permission as the script always runs on the Graph API permissions assigned to the registered app.

2 Replies
I managed to have the script running via a runbook (import-module Microsoft.Graph.Authentication), but have the same result as with the single managed service account. I have used write-output to see what is going on in the script and i can see that it is retrieving the Guests account as expected.
29/3/2024 15:55:01
Output
Retrived 317 guest accounts which did not accept their invitation
29/3/2024 15:55:02
Output
retrieved 302 guest accounts which have not accepted the invitation in the last 90 days

Looking at the output, i sort of getting a idea why the final report says:
Summary
Entra ID contained 0 guest accounts, of which 0 and 0 have been deducted.
Which brings the remaining Guest accounts to 0.
I use two registered apps, one to perform the operations and one to send email notifications. Wherefore i am guessing that it creates two sessions, and variable are not available in the second session wherefore the Object counts are 0.
best response confirmed by TherealKillerbe (Brass Contributor)
Solution
For those who do not know, this feature was recently moved from Entra P2 to require an add-on license called "Microsoft Entra ID Governance." Reference: https://learn.microsoft.com/en-us/entra/identity/users/clean-up-stale-guest-accounts#license-require...
1 best response

Accepted Solutions
best response confirmed by TherealKillerbe (Brass Contributor)
Solution
For those who do not know, this feature was recently moved from Entra P2 to require an add-on license called "Microsoft Entra ID Governance." Reference: https://learn.microsoft.com/en-us/entra/identity/users/clean-up-stale-guest-accounts#license-require...

View solution in original post