{"id":28028,"date":"2024-07-26T09:23:13","date_gmt":"2024-07-26T07:23:13","guid":{"rendered":"https:\/\/my-iam.com\/?p=28028"},"modified":"2024-07-26T09:23:13","modified_gmt":"2024-07-26T07:23:13","slug":"automatically-delete-inactive-guest-accounts","status":"publish","type":"post","link":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/","title":{"rendered":"Automatically delete inactive guest accounts"},"content":{"rendered":"<p>The <strong>management of guest accounts in Entra ID<\/strong> is an important aspect of an organization&#8217;s <strong>security and compliance policies<\/strong>. Inactive guest accounts create a potential security risk, as they could be misused by unauthorized users. To minimize these risks, it is important to regularly check inactive guest accounts and delete them if necessary.<\/p>\n<p>Azure Automation Runbooks provide an automated resolution of inactive guest accounts to accomplish this task efficiently and reliably. In this guide, we will set up an Azure Automation Runbook that automatically deletes inactive guest accounts after 90 days of inactivity.<\/p>\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-white ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Index<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Advantages_to_automatically_delete_inactive_guest_accounts\" >Advantages to automatically delete inactive guest accounts<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Azure_Automation_Runbooks_as_a_solution\" >Azure Automation Runbooks as a solution<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Instructions_for_creating_an_Azure_Automation_Runbook\" >Instructions for creating an Azure Automation Runbook<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Create_an_Azure_Automation_account\" >Create an Azure Automation account<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Creating_a_runbook\" >Creating a runbook<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Assign_authorizations\" >Assign authorizations<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Install_additional_PowerShell_modules\" >Install additional PowerShell modules<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Set_up_and_test_planned_task\" >Set up and test planned task<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#Fazit\" >Fazit<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#my-IAM_RealIdentity_for_Providing_All_Types_of_Identities\" >my-IAM RealIdentity for Providing All Types of Identities<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Advantages_to_automatically_delete_inactive_guest_accounts\"><\/span>Advantages to automatically delete inactive guest accounts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Increased security<\/strong>: Deleting inactive accounts reduces the attack surface for potential security threats.<\/p>\n<p><strong>Improved directory management<\/strong>: A tidy directory makes management easier and reduces administrative effort.<\/p>\n<p><strong>Cost savings<\/strong>: Avoidance of unnecessary license costs and optimization of resource usage.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Azure_Automation_Runbooks_as_a_solution\"><\/span>Azure Automation Runbooks as a solution<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Azure Automation Runbooks<\/strong> enable the<strong> automation of administrative tasks in Azure<\/strong>. They provide a robust platform to efficiently automate recurring tasks, such as monitoring and deleting inactive guest accounts. Runbooks can be used to <strong>create complex workflows<\/strong> that are executed regularly to ensure policies are enforced.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Instructions_for_creating_an_Azure_Automation_Runbook\"><\/span>Instructions for creating an Azure Automation Runbook<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Create_an_Azure_Automation_account\"><\/span>Create an Azure Automation account<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>1. log in to the Azure portal at <a href=\"https:\/\/portal.azure.com\">https:\/\/portal.azure.com<\/a>.<\/p>\n<p><img decoding=\"async\" class=\"alignnone wp-image-28030 size-full\" title=\"Login to Entra ID to delete inactive guest accounts\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden.png\" alt=\"Login to Entra ID - Azure AD Portal - to delete inactive guest accounts\" width=\"1822\" height=\"921\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden.png 1822w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden-300x152.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden-1024x518.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden-768x388.png 768w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden-1536x776.png 1536w\" sizes=\"(max-width: 1822px) 100vw, 1822px\" \/><\/p>\n<p>2. create a new resource group for the services via \u201c<strong>Create resource<\/strong>\u201d.<\/p>\n<p><img decoding=\"async\" class=\"alignnone wp-image-28036 size-full\" title=\"Create resources in Microsoft Azure - inactive guest accounts\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/2_Ressource-Erstellen-1.png\" alt=\"Create resources in Microsoft Azure - inactive guest accounts\" width=\"1823\" height=\"856\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/2_Ressource-Erstellen-1.png 1823w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/2_Ressource-Erstellen-1-300x141.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/2_Ressource-Erstellen-1-1024x481.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/2_Ressource-Erstellen-1-768x361.png 768w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/2_Ressource-Erstellen-1-1536x721.png 1536w\" sizes=\"(max-width: 1823px) 100vw, 1823px\" \/><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-28034 size-full\" title=\"Create a group with inactive guest accounts\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/3_Create-a-resource-group-e1721977779706.png\" alt=\"Create a group with inactive guest accounts\" width=\"1201\" height=\"472\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/3_Create-a-resource-group-e1721977779706.png 1201w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/3_Create-a-resource-group-e1721977779706-300x118.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/3_Create-a-resource-group-e1721977779706-1024x402.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/3_Create-a-resource-group-e1721977779706-768x302.png 768w\" sizes=\"(max-width: 1201px) 100vw, 1201px\" \/><\/p>\n<p>3. in the next step, we create an <strong>Automation account<\/strong> that is <strong>to execute our PowerShell script<\/strong>. To do this, we go back to \u201cCreate resource\u201d and search for \u201cAutomation account\u201d<\/p>\n<p><img decoding=\"async\" class=\"alignnone wp-image-28038 size-full\" title=\"Create an automated group with inactive guest accounts. - Delete guest accounts after 90 days\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/4_Automation-Account.png\" alt=\"Create an automated group with inactive guest accounts. - Delete guest accounts after 90 days\" width=\"1183\" height=\"889\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/4_Automation-Account.png 1183w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/4_Automation-Account-300x225.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/4_Automation-Account-1024x770.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/4_Automation-Account-768x577.png 768w\" sizes=\"(max-width: 1183px) 100vw, 1183px\" \/><\/p>\n<p>4. make sure that the<strong> \u201cSystem-assigned managed identity\u201d option was enabled<\/strong> when the automation account was created. <strong>Note<\/strong>: I strongly recommend using this option instead of the soon-to-be phased out \u201cRun as account\u201d option.<\/p>\n<p><img decoding=\"async\" class=\"alignnone wp-image-28040 size-full\" title=\"EntraIdentity - Automation\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/5_Ausfuehren-als-Konto.png\" alt=\"EntraIdentity - Automation\" width=\"1822\" height=\"889\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/5_Ausfuehren-als-Konto.png 1822w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/5_Ausfuehren-als-Konto-300x146.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/5_Ausfuehren-als-Konto-1024x500.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/5_Ausfuehren-als-Konto-768x375.png 768w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/5_Ausfuehren-als-Konto-1536x749.png 1536w\" sizes=\"(max-width: 1822px) 100vw, 1822px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"Creating_a_runbook\"><\/span>Creating a runbook<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>1. Let&#8217;s access the newly created automation account to initiate the creation of a new runbook.<\/p>\n<p><img decoding=\"async\" class=\"alignnone wp-image-28042 size-full\" title=\"Create runbooks in Entra ID\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/6_-Automatisierungskontos-um-ein-neues-Runbook-zu-erstellen.-.png.png\" alt=\"Create runbooks in Entra ID\" width=\"1824\" height=\"859\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/6_-Automatisierungskontos-um-ein-neues-Runbook-zu-erstellen.-.png.png 1824w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/6_-Automatisierungskontos-um-ein-neues-Runbook-zu-erstellen.-.png-300x141.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/6_-Automatisierungskontos-um-ein-neues-Runbook-zu-erstellen.-.png-1024x482.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/6_-Automatisierungskontos-um-ein-neues-Runbook-zu-erstellen.-.png-768x362.png 768w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/6_-Automatisierungskontos-um-ein-neues-Runbook-zu-erstellen.-.png-1536x723.png 1536w\" sizes=\"(max-width: 1824px) 100vw, 1824px\" \/><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-28044 \" title=\"Create runbooks in Entra ID with inactive guest accounts. \" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/7_Create-Runbook.png\" alt=\"Create runbooks in Entra ID with inactive guest accounts. \" width=\"591\" height=\"443\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/7_Create-Runbook.png 1184w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/7_Create-Runbook-300x225.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/7_Create-Runbook-1024x767.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/7_Create-Runbook-768x575.png 768w\" sizes=\"(max-width: 591px) 100vw, 591px\" \/><\/p>\n<p>2. once we have created our runbook, insert the code below with the <strong>script to identify and delete inactive guest accounts<\/strong>.<\/p>\n<pre class=\"lang:default decode:true\"># Author: Max Mueller(max.mueller@firstattribute.com)\r\n# Description: Script monitors Azure Active Directory guest users last login and remove them\r\n# when login greather than x days\r\n# Version: 1.0\r\n# Created on: 18.12.2023\r\n# Last Change: 18.12.2023\r\n# Changed by: Max Mueller\r\n# ===========================================================================================\r\n# Change History:\r\n#\r\n# Release: | Date: | Author: | Changes:\r\n# -----------+------------+---------------+-------------------------------------------------\r\n# 1.0 | 18.12.2023 | M. Mueller| Creation\r\n\r\n$inactiveDays = 90\r\n$inactiveDate = (Get-Date).AddDays(-$inactiveDays)\r\n\r\n$body = \"{0} has been inactive for over $($inactiveDays) days. {0} will be remove now, last logon on: {1}\"\r\n$bodyNoLogin = \"{0} has no login at now.\"\r\n\r\n\r\nWrite-Output (\"[info] Starting watch inactive entraID guest users...\")\r\nConnect-MgGraph -Identity -NoWelcome\r\n$guestsEntraID = Get-MgUser -ConsistencyLevel eventual -Count userCount -Filter \"UserType eq 'Guest'\" -Property Id, DisplayName, UserPrincipalName, UserType, SignInActivity -top 10000\r\n\r\nWrite-Output (\"[info] \" + ($guestsEntraID.Count).ToString() + \" active users found in AD.\")\r\nforeach($guestEntraID in $guestsEntraID) {\r\nWrite-Debug (\"[debug] Checking \" + $guestEntraID.UserPrincipalName + \" last login date...\")\r\ntry {\r\nif ($null -eq $guestEntraID.SignInActivity.LastSignInDateTime) {\r\nWrite-Warning -Message (\"[warn] \" + $bodyNoLogin -f $guestEntraID.DisplayName, $guestEntraID.SignInActivity.LastSignInDateTime)\r\ncontinue\r\n}\r\nif ($guestEntraID.SignInActivity.LastSignInDateTime -lt $inactiveDate){\r\nWrite-Output (\"[info] \" + $body -f $guestEntraID.DisplayName, $guestEntraID.SignInActivity.LastSignInDateTime)\r\nRemove-MgUser -UserId $guestEntraID.Id\r\n}\r\n}\r\ncatch {\r\nWrite-Error -Message (\"[error] Error at remove entraID guest $($guestEntraID.DisplayName), message: $($_.Exception.Message)\")\r\n}\r\n}<\/pre>\n<p>&nbsp;<\/p>\n<p><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">3. once the code has been inserted, click on \u201c<strong>Save<\/strong>\u201d and then on \u201c<strong>Publish<\/strong>\u201d. <\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-28045\" title=\"Watch-InactiveGuestAccounts\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/8_-Code-eingefuegt-auf-\u201eSpeichern-.png\" alt=\"Watch-InactiveGuestAccounts\" width=\"654\" height=\"320\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/8_-Code-eingefuegt-auf-\u201eSpeichern-.png 1818w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/8_-Code-eingefuegt-auf-\u201eSpeichern--300x147.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/8_-Code-eingefuegt-auf-\u201eSpeichern--1024x501.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/8_-Code-eingefuegt-auf-\u201eSpeichern--768x376.png 768w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/8_-Code-eingefuegt-auf-\u201eSpeichern--1536x752.png 1536w\" sizes=\"(max-width: 654px) 100vw, 654px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"Assign_authorizations\"><\/span>Assign authorizations<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The <strong>managed identity requires rights<\/strong> in order <strong>to be able to communicate with the Microsoft Graph API<\/strong>. There is no GUI for this and the commands must be executed with PowerShell.<\/p>\n<p>In the PowerShell snippet, the variables <strong>$TenantID, $DisplayNameOfMSI<\/strong> and <strong>$PermissionName<\/strong> must be supplemented with the current values in order to then be able to add the authorizations for <strong>AuditLog.Read.All<\/strong> and <strong>User.ReadWrite.All.<\/strong><\/p>\n<pre class=\"lang:default decode:true \">$TenantID=\"&lt;your tenant id&gt;\"\r\n$GraphAppId = \"00000003-0000-0000-c000-000000000000\"\r\n$DisplayNameOfMSI=\"&lt;name of managed identity&gt;\"\r\n$PermissionName = \"User.ReadWrite.All\"\r\n\r\nInstall-Module AzureAD\r\nConnect-AzureAD -TenantId $TenantID\r\n\r\n$MSI = (Get-AzureADServicePrincipal -Filter \"displayName eq '$DisplayNameOfMSI'\")\r\n$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter \"appId eq '$GraphAppId'\"\r\n$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains \"Application\"}\r\n\r\nNew-AzureAdServiceAppRoleAssignment -ObjectId $MSI.ObjectId -PrincipalId $MSI.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id<\/pre>\n<p>&nbsp;<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Install_additional_PowerShell_modules\"><\/span>Install additional PowerShell modules<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>In order for the modules used to be loaded, we need to <strong>import them into our Automation account<\/strong>.<\/p>\n<ol>\n<li>Navigate to the automation account and click on \u201cAdd a module\u201d under the \u201cModules\u201d menu item.<\/li>\n<\/ol>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-28047\" title=\"Install additional PowerShell modules \" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/9_Zusaetzliche-PowerShell-Module.png\" alt=\"Install additional PowerShell modules \" width=\"721\" height=\"351\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/9_Zusaetzliche-PowerShell-Module.png 1820w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/9_Zusaetzliche-PowerShell-Module-300x146.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/9_Zusaetzliche-PowerShell-Module-1024x498.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/9_Zusaetzliche-PowerShell-Module-768x374.png 768w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/9_Zusaetzliche-PowerShell-Module-1536x748.png 1536w\" sizes=\"(max-width: 721px) 100vw, 721px\" \/><\/p>\n<p>Here we select the following modules from the PS Gallery:<\/p>\n<ul>\n<li>Microsoft.Graph.Authentication<\/li>\n<li>Microsoft.Graph.Users<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Set_up_and_test_planned_task\"><\/span><img decoding=\"async\" class=\"aligncenter wp-image-28049\" title=\"Install additional PowerShell modules \" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/10_Module-aus-der-PS-Gallery-aus.png\" alt=\"Install additional PowerShell modules \" width=\"793\" height=\"390\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/10_Module-aus-der-PS-Gallery-aus.png 1194w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/10_Module-aus-der-PS-Gallery-aus-300x147.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/10_Module-aus-der-PS-Gallery-aus-1024x503.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/10_Module-aus-der-PS-Gallery-aus-768x378.png 768w\" sizes=\"(max-width: 793px) 100vw, 793px\" \/>Set up and test planned task<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Once all the steps have been completed, we need to <strong>set a timer and test the runbook<\/strong> for the automatic deletion of inactive guest accounts.<\/p>\n<p>To do this, we select our runbook and create a new timer. In our case, we run the script daily.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-28051\" title=\"Set up and test planned task\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/11_Geplante-Aufgabe-einrichten-und-Testen.png\" alt=\"Set up and test planned task\" width=\"1056\" height=\"506\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/11_Geplante-Aufgabe-einrichten-und-Testen.png 1821w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/11_Geplante-Aufgabe-einrichten-und-Testen-300x144.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/11_Geplante-Aufgabe-einrichten-und-Testen-1024x491.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/11_Geplante-Aufgabe-einrichten-und-Testen-768x368.png 768w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/11_Geplante-Aufgabe-einrichten-und-Testen-1536x736.png 1536w\" sizes=\"(max-width: 1056px) 100vw, 1056px\" \/><\/p>\n<p>After we have set the timer, we <strong>start the runbook<\/strong> in the overview page, where we can also <strong>view the log entries<\/strong> that our script has created.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-28053\" title=\"View log entries of inactive guest accounts.\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/12_Log-Eintraege-einsehen.png\" alt=\"View log entries of inactive guest accounts. - Deletion of inactive guest accounts\" width=\"870\" height=\"420\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/12_Log-Eintraege-einsehen.png 1822w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/12_Log-Eintraege-einsehen-300x145.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/12_Log-Eintraege-einsehen-1024x495.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/12_Log-Eintraege-einsehen-768x371.png 768w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/12_Log-Eintraege-einsehen-1536x742.png 1536w\" sizes=\"(max-width: 870px) 100vw, 870px\" \/><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-28092\" title=\"View log entries\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/Logeintraege-einsehen.png\" alt=\"View log entries\" width=\"465\" height=\"340\" srcset=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/Logeintraege-einsehen.png 1088w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/Logeintraege-einsehen-300x219.png 300w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/Logeintraege-einsehen-1024x748.png 1024w, https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/Logeintraege-einsehen-768x561.png 768w\" sizes=\"(max-width: 465px) 100vw, 465px\" \/><\/p>\n<h2><span class=\"ez-toc-section\" id=\"Fazit\"><\/span>Fazit<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Automatically deleting inactive guest accounts using Azure Automation Runbooks<\/strong> ensures that our directory always remains up-to-date and secure. By regularly checking and cleaning up the directory, potential security gaps can be closed and administrative effort reduced. Azure Automation offers a flexible and scalable solution that can be seamlessly integrated into our existing workflows.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"my-IAM_RealIdentity_for_Providing_All_Types_of_Identities\"><\/span>my-IAM RealIdentity for Providing All Types of Identities<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img decoding=\"async\" class=\"wp-image-27598 alignleft\" title=\"my-IAM PeopleConnect\" src=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/06\/my-IAM-RealIdentity_2-3.gif\" alt=\"\" width=\"150\" height=\"127\" \/><\/p>\n<p>Our cloud service, my-IAM RealIdentity, enables distributed identity management:<\/p>\n<p>RealIdentity collects identity data from various source systems, sorts, combines, cleanses, and updates the data, and makes it available for all kinds of applications. Consequently, companies use RealIdentity as the primary source for their identity data required in external applications.<\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/my-iam.com\/en\/book-a-demo\/\" rel=\"noopener\"><button class=\"ButtonBeratung aligncenter\">Book an online demo now<\/button><\/a><\/p>\n<p style=\"text-align: center;\">You can also reach our team by telephone at<br \/>\n<a href=\"tel:+4981969984330\"><strong>+49 8196 998 4330<\/strong><\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The management of guest accounts in Entra ID is an important aspect of an organization&#8217;s security and compliance policies. Inactive [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[3213,3405],"tags":[3406,3408,3407],"class_list":["post-28028","post","type-post","status-publish","format-standard","hentry","category-entra-id-en","category-my-iam-realidentity-en","tag-inactive-guest-accounts","tag-powershell-en","tag-runbooks-azure-automation"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Automatically delete inactive guest accounts - my-IAM<\/title>\n<meta name=\"description\" content=\"Automatically delete inactive guest accounts - With Runbook, guest accounts are deleted after 90 days of inactivity in Entra ID.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Automatically delete inactive guest accounts - my-IAM\" \/>\n<meta property=\"og:description\" content=\"Automatically delete inactive guest accounts - With Runbook, guest accounts are deleted after 90 days of inactivity in Entra ID.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/\" \/>\n<meta property=\"og:site_name\" content=\"my-IAM\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/firstattribute\" \/>\n<meta property=\"article:published_time\" content=\"2024-07-26T07:23:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden.png\" \/>\n<meta name=\"author\" content=\"Elysabeth Yven\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Elysabeth Yven\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/\"},\"author\":{\"name\":\"Elysabeth Yven\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#\\\/schema\\\/person\\\/cb96a6c7bc8321c5a023ea9fccd6f359\"},\"headline\":\"Automatically delete inactive guest accounts\",\"datePublished\":\"2024-07-26T07:23:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/\"},\"wordCount\":673,\"publisher\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/my-iam.com\\\/wp-content\\\/uploads\\\/2024\\\/07\\\/1_Azure-Portal-anmelden.png\",\"keywords\":[\"inactive guest accounts\",\"PowerShell\",\"Runbooks Azure Automation\"],\"articleSection\":[\"Entra ID\",\"my-IAM RealIdentity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/\",\"url\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/\",\"name\":\"Automatically delete inactive guest accounts - my-IAM\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/my-iam.com\\\/wp-content\\\/uploads\\\/2024\\\/07\\\/1_Azure-Portal-anmelden.png\",\"datePublished\":\"2024-07-26T07:23:13+00:00\",\"description\":\"Automatically delete inactive guest accounts - With Runbook, guest accounts are deleted after 90 days of inactivity in Entra ID.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/#primaryimage\",\"url\":\"https:\\\/\\\/my-iam.com\\\/wp-content\\\/uploads\\\/2024\\\/07\\\/1_Azure-Portal-anmelden.png\",\"contentUrl\":\"https:\\\/\\\/my-iam.com\\\/wp-content\\\/uploads\\\/2024\\\/07\\\/1_Azure-Portal-anmelden.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/en\\\/automatically-delete-inactive-guest-accounts\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/my-iam.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Automatically delete inactive guest accounts\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#website\",\"url\":\"https:\\\/\\\/my-iam.com\\\/de\\\/\",\"name\":\"my-IAM\",\"description\":\"Identity Access Management, Active Directory Spezialisten\",\"publisher\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/my-iam.com\\\/de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#organization\",\"name\":\"my-IAM\",\"url\":\"https:\\\/\\\/my-iam.com\\\/de\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/my-iam.com\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/Logo-my-IAM-blau-512-150x150-2.png\",\"contentUrl\":\"https:\\\/\\\/my-iam.com\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/Logo-my-IAM-blau-512-150x150-2.png\",\"width\":200,\"height\":200,\"caption\":\"my-IAM\"},\"image\":{\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/firstattribute\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/my-iam.com\\\/de\\\/#\\\/schema\\\/person\\\/cb96a6c7bc8321c5a023ea9fccd6f359\",\"name\":\"Elysabeth Yven\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Automatically delete inactive guest accounts - my-IAM","description":"Automatically delete inactive guest accounts - With Runbook, guest accounts are deleted after 90 days of inactivity in Entra ID.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/","og_locale":"en_US","og_type":"article","og_title":"Automatically delete inactive guest accounts - my-IAM","og_description":"Automatically delete inactive guest accounts - With Runbook, guest accounts are deleted after 90 days of inactivity in Entra ID.","og_url":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/","og_site_name":"my-IAM","article_publisher":"https:\/\/www.facebook.com\/firstattribute","article_published_time":"2024-07-26T07:23:13+00:00","og_image":[{"url":"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden.png","type":"","width":"","height":""}],"author":"Elysabeth Yven","twitter_misc":{"Written by":"Elysabeth Yven","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#article","isPartOf":{"@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/"},"author":{"name":"Elysabeth Yven","@id":"https:\/\/my-iam.com\/de\/#\/schema\/person\/cb96a6c7bc8321c5a023ea9fccd6f359"},"headline":"Automatically delete inactive guest accounts","datePublished":"2024-07-26T07:23:13+00:00","mainEntityOfPage":{"@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/"},"wordCount":673,"publisher":{"@id":"https:\/\/my-iam.com\/de\/#organization"},"image":{"@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#primaryimage"},"thumbnailUrl":"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden.png","keywords":["inactive guest accounts","PowerShell","Runbooks Azure Automation"],"articleSection":["Entra ID","my-IAM RealIdentity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/","url":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/","name":"Automatically delete inactive guest accounts - my-IAM","isPartOf":{"@id":"https:\/\/my-iam.com\/de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#primaryimage"},"image":{"@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#primaryimage"},"thumbnailUrl":"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden.png","datePublished":"2024-07-26T07:23:13+00:00","description":"Automatically delete inactive guest accounts - With Runbook, guest accounts are deleted after 90 days of inactivity in Entra ID.","breadcrumb":{"@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#primaryimage","url":"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden.png","contentUrl":"https:\/\/my-iam.com\/wp-content\/uploads\/2024\/07\/1_Azure-Portal-anmelden.png"},{"@type":"BreadcrumbList","@id":"https:\/\/my-iam.com\/en\/automatically-delete-inactive-guest-accounts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/my-iam.com\/en\/"},{"@type":"ListItem","position":2,"name":"Automatically delete inactive guest accounts"}]},{"@type":"WebSite","@id":"https:\/\/my-iam.com\/de\/#website","url":"https:\/\/my-iam.com\/de\/","name":"my-IAM","description":"Identity Access Management, Active Directory Spezialisten","publisher":{"@id":"https:\/\/my-iam.com\/de\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/my-iam.com\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/my-iam.com\/de\/#organization","name":"my-IAM","url":"https:\/\/my-iam.com\/de\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/my-iam.com\/de\/#\/schema\/logo\/image\/","url":"https:\/\/my-iam.com\/wp-content\/uploads\/2021\/07\/Logo-my-IAM-blau-512-150x150-2.png","contentUrl":"https:\/\/my-iam.com\/wp-content\/uploads\/2021\/07\/Logo-my-IAM-blau-512-150x150-2.png","width":200,"height":200,"caption":"my-IAM"},"image":{"@id":"https:\/\/my-iam.com\/de\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/firstattribute"]},{"@type":"Person","@id":"https:\/\/my-iam.com\/de\/#\/schema\/person\/cb96a6c7bc8321c5a023ea9fccd6f359","name":"Elysabeth Yven"}]}},"_links":{"self":[{"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/posts\/28028","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/comments?post=28028"}],"version-history":[{"count":3,"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/posts\/28028\/revisions"}],"predecessor-version":[{"id":28137,"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/posts\/28028\/revisions\/28137"}],"wp:attachment":[{"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/media?parent=28028"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/categories?post=28028"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/my-iam.com\/en\/wp-json\/wp\/v2\/tags?post=28028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}