Opselith
POWERSHELL / MICROSOFT.GRAPH.USERS
FreeAdvancedRead-onlylow

Find disabled Entra users with recent sign-in

Find disabled Microsoft Entra users whose available sign-in activity shows a recent successful sign-in.

Open in PowerShell Builder →Browse all scripts

Generated locally in your browser · Review before running · Opselith does not connect to your tenant

What this PowerShell script does

Finds disabled users that still have recent sign-in activity.

Requirements

  • Days back - e.g. 30
  • CSV output path - Example: C:\Temp\report.csv

Environment

  • Module: Microsoft.Graph.Users
  • Permissions: AuditLog.Read.All; User.Read.All; Microsoft Entra ID P1/P2 for signInActivity details
  • Output: CSV report
  • Context: PowerShell 7 · Microsoft Graph
  • Risk: Low
Review before you run The script is generated locally. Test outside production first.
NEXT STEP

Ready to generate

Configure Find disabled Entra users with recent sign-in in the Builder, review the generated PowerShell and run it yourself in your own PowerShell session.

Configure this script →Open Builder
More about this script

Why use this template?

Use this PowerShell template when you need to find disabled users that still have recent sign-in activity. It is generated locally and can be reviewed before you run it yourself in your own PowerShell session.

The template uses Microsoft.Graph.Users and requires AuditLog.Read.All; User.Read.All; Microsoft Entra ID P1/P2 for signInActivity details. Output: CSV report. Level: Advanced. Action: Read-only. Risk: Low.

Review before running

The script is generated in your browser. Read it before you run it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.

Generate the script

  1. Open the template in the PowerShell Builder.
  2. Enter the requested values and review the module, permissions, output and risk.
  3. Generate the script, read it carefully, and test it outside production before use.

The script is generated locally in your browser. Nothing needs to be uploaded to Opselith.

Generate Find disabled Entra users with recent sign-in →

How to use this result

Use this report to flag currently disabled accounts that also have a recent LastSuccessfulSignInDateTime value.

When this helps

  • Investigate disabled accounts that still show recent successful activity in the available sign-in history.
  • Add a focused exception check to account-offboarding or access-review work.

How to read the result

  • The script compares current AccountEnabled=false with LastSuccessfulSignInDateTime inside the selected period.
  • A match does not prove the successful sign-in happened after the account was disabled because this report does not correlate a disable-event timestamp.

Things to check

  • Microsoft documents limitations and reporting delay for signInActivity; blank or delayed values should be treated as unknown rather than proof of inactivity.
  • Investigate the sign-in event and account change history before treating a row as a control failure.

What to do next: Correlate the account with sign-in logs and audit history to establish event order before remediation.

Related tasks

Official references

Before you runModule, permissions, inputs, compatibility and script checks
OPS / SCRIPT DETAILS

Script details

Finds disabled users that still have recent sign-in activity. Review these details before generating or running the script.

securityfindusersentradisabled
Generated here. Run by you.Opselith does not connect to your tenant or run PowerShell. After generating, review the script and run it in your own PowerShell session.

What it works with

Module: Microsoft.Graph.Users

Microsoft Graph PowerShell lets the script work with Microsoft Entra and Microsoft 365 data through Microsoft Graph.

Context: PowerShell 7 · Microsoft Graph

Compatibility: PowerShell 7 is the supported target for this Microsoft 365 template.

Permissions and changes

Permissions: AuditLog.Read.All; User.Read.All; Reports Reader (or an equivalent supported reader role); Microsoft Entra ID P1/P2 for signInActivity details

Risk: Low

Read-only: designed to collect information without intentionally changing the target environment.

Changes: Read-only. The script reads data and does not intentionally change the target environment.

Inputs

  • Days back - e.g. 30 (Required)
  • CSV output path - Example: C:\Temp\report.csv (Required)

What to expect

Output: CSV report

Expect a CSV file at the path you choose. Open it in Excel or another CSV viewer and review the rows.

Example: C:\Temp\report.csv

This template is in the Free library and is generated locally in your browser. Opselith does not run it; you review and run the script in your own PowerShell session.

Example use

Finds disabled users that still have recent sign-in activity.

Enter the required values in the Builder, review the generated script and confirm the output before running it.

Before you run: Make sure your account has AuditLog.Read.All; User.Read.All; Reports Reader (or an equivalent supported reader role); Microsoft Entra ID P1/P2 for signInActivity details. Check that the Microsoft.Graph.Users PowerShell module is available and that you are using the supported PowerShell version. Review the generated script and output path, then test outside production first.
Script checksWhat has been verifiedQA reviewed
Static checksPassed
PSScriptAnalyzerPending
Real-world run testNot yet recorded
Last checkedNot yet recorded

Real-world run results are shown only after Opselith reviews and accepts a tester report.

Tester: report a result →
TEST STATUSWhat Opselith has checked

Last reviewed: 28 Aug 2026

PSScriptAnalyzer: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.

Pending or Not yet recorded means there is no accepted result on file yet. A passed analyzer check does not mean the script has been run in a real tenant.

NEXT IN THE LIBRARY

Scripts for similar admin tasks and Microsoft services.

Browse Microsoft Entra PowerShell scripts →
POWERSHELLFind Entra guests older than a thresholdsecurity · find · usersPOWERSHELLExport Entra authentication registration statussecurity · export · usersPOWERSHELLFind AD passwords expiring soonsecurity · find · users