You request a list of all users, and the last lastSignInDateTime for each respective user: Last sign-in date and time for all users: In this scenario, you need to generate a report of the last sign-in date of all users. Using this property, you can implement a solution for the following scenarios: The lastSignInDateTime property shows the last time a user attempted to make an interactive sign-in attempt in Azure AD. You can detect inactive accounts by evaluating the lastSignInDateTime property exposed by the signInActivity resource type of the Microsoft Graph API. Detect inactive user accounts with Microsoft Graph For external user management, you can understand if an external user is still active within the tenant or should be cleaned up. It can help with determining if group membership or app access is still needed or could be removed. The last sign-in provides potential insights into a user's continued need for access to resources. In many organizations, the delta for inactive user accounts is between 90 and 180 days.

When defining what your delta for inactive user accounts is, you need to factor in all legitimate reasons for not signing in to your environment. For example, users might not sign in to an environment for a while, because they are on vacation. The challenge of this method is to define what for a while means for your environment. Because inactive accounts are tied to the sign-in activity, you can use the timestamp of the last time an account attempted to sign in to detect inactive accounts.

One key identifier for inactive accounts is that they haven't been used for a while to sign in to your environment. Inactive accounts are user accounts that aren't required anymore by members of your organization to gain access to your resources. This article explains a method to handle obsolete user accounts in Azure Active Directory (Azure AD). As an IT administrator, you want to detect and resolve these obsolete user accounts because they represent a security risk. In large environments, user accounts aren't always deleted when employees leave an organization.

Microsoft 365 accounts