Find disabled Entra users with recent sign-in
Finds disabled users that still have recent sign-in activity.
What this PowerShell script does
Finds disabled users that still have recent sign-in activity.
Requirements
- Days back — e.g. 30
- CSV output path — Example: C:\Temp\report.csv
Environment
- Module: Microsoft.Graph.Users
- Permissions: AuditLog.Read.All, User.Read.All
- Output: CSV report
- Context: PowerShell 7 · Microsoft Graph
- Risk: Low
Why use this template?
Use this PowerShell template when you need to Finds disabled users that still have recent sign-in activity. It is generated locally and can be reviewed before you run it in your own environment.
The template uses Microsoft.Graph.Users and requires AuditLog.Read.All, User.Read.All. Output: CSV report. Level: Advanced. Action: Read-only. Risk: Low.
Review before running
The script is generated in your browser. Read it before you run it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.
Generate the script
Fill in the values in the Builder, review the generated command and then copy or download it. Nothing needs to be uploaded to Opselith.
Generate Find disabled Entra users with recent sign-in →