How to Cleanup your M365 or AzureAD Guest Users account ?

Cleanup Guest user accounts from Basic Azure AD/ Premium P1 Tenant

             Clean the stalled Guest user accounts from Microsoft365 tenant is very important to maintain the security of your tenant in-line and reduce the attack surface of your tenant. But this is challenging, when you are using Basic Azure AD  or Azure AD Premium P1 License, since this license plan is not included the Access review features, hence cleaning up the Guest user account is challenging for basic AD Licensing Tenant.

              But as a M365 Administrator it's our responsibility to find them and clean those stalled guest accounts. In this article it will give you an idea to cleanup guest user accounts without using PowerShell.

Roles needed to perform this activity:

1.Global administrator role

2.User administrator role

Why do we need to cleanup Guest account?

          Once we invite external guest users to collaborate with our Microsoft 365 resources like teams, SharePoint, Power BI, etc.., Once the invitation sent guest user account has been created in our Azure AD. The Guest user ID will receive notification to their email ID.

Below are the reason to clean up guest account,

        1. The guest user may or mayn't accept invitation at any reason, incase if the guest user account (@gmail.com,@abc.com) compromised after we sent the invitation the attacker could get it to our tenant with the invitation.

        2. Since the guest user account IAM is managed by their Org IT team we don't know the security hardness of their account, so cleaning up Guest account is in-evitable.  

        3. Microsoft 365 Security Score also impact because of the Guest user account. Because per user MFA also included in the Security Score, (Example) if Guest account created not logged in and not completed MFA that also will reduce your tenant security score.

        4. Ideally if a guest account is not actively using in our tenant what is use of having such account.

How to clear the stalled guest accounts?

Based on Invitation State:

    1. AzureAD --> Users --> Filtered with User type as below --> Download Users.

    2. Make sure you have "invitation state" option in the export file.

•    By Using the invitation state option you can filter the "Invitation Pending". 
•    Copy those Pending users details in separate Excel.
•    By using the bulk operation we can delete them all.

Based on last logon (30 days not logged-in):

    1. Export last 30 days of User Sign-in logs from Azure AD. -->  select "last 30 days" --> Download CSV --> InteractiveSignIns.

              

    2. Compare this sheet's "User ID" with Guest user details exported sheet's "ID". (The mentioned options are only common in both Sheets).

    3. If the guest account is not present in 30 days signin data, you may delete them.

    4. if you want to delete only 60 days not logged in users, you should have the Azure sign in for 60 days.

    5. To have 60 days or more than 30 days sign in logs, you should have Azure log analytics to store that data.

    6. As per Microsoft basic AzureAD or AzureAD P1 Subscription by default it will give only 30 days of SignIn data.

    7. To avoid this cost investment, you may have to define process such a way like "Every month end (28th) you should download last 30 days of Azure SignIn Report for Guest users".

    8.This can be done through PowerShell Script or manually based on your wise. By using this 60 Days data (2 months 28th Exported) you can do cleanup the guest accounts which are not logged in more than 60 days.

    9. The same approach can be followed for two month once or monthly basis.