Stop debugging broken Graph scripts and SailPoint Transforms in production.

#Requires -Version 5.1
#Requires -Modules @{ ModuleName = 'Microsoft.Graph.Authentication'; ModuleVersion = '2.0.0' }
#Requires -Modules @{ ModuleName = 'Microsoft.Graph.Users'; ModuleVersion = '2.0.0' }
#Requires -Modules @{ ModuleName = 'Microsoft.Graph.Users.Actions'; ModuleVersion = '2.0.0' }
 
<#
.SYNOPSIS
  Audits Entra ID guests with no sign-in for 90 days and revokes their refresh tokens.
.NOTES
  Microsoft Graph PowerShell SDK v2 only.
  signInActivity requires AuditLog.Read.All plus ConsistencyLevel eventual.
  The CSV is written on the operator workstation and is not uploaded.
#>
 
$ErrorActionPreference = 'Stop'
$cutoff = (Get-Date).ToUniversalTime().AddDays(-90)
 
Connect-MgGraph -Scopes @(
    'User.Read.All'
    'AuditLog.Read.All'
    'User.RevokeSessions.All'
)
 
$guests = Get-MgUser -Filter "userType eq 'Guest'" -All `
    -ConsistencyLevel eventual `
    -CountVariable guestCount `
    -Property @(
        'id'
        'userPrincipalName'
        'displayName'
        'createdDateTime'
        'signInActivity'
        'accountEnabled'
    )
 
$inactive = [System.Collections.Generic.List[object]]::new()
 
foreach ($guest in $guests) {
    $activity = $guest.SignInActivity
    $lastSignIn = $null
    $lastNonInteractive = $null
    if ($null -ne $activity) {
        $lastSignIn = $activity.LastSignInDateTime
        $lastNonInteractive = $activity.LastNonInteractiveSignInDateTime
    }
 
    $candidates = @($lastSignIn, $lastNonInteractive) |
        Where-Object { $null -ne $_ } |
        Sort-Object -Descending
    $lastActivity = $candidates | Select-Object -First 1
    $created = $guest.CreatedDateTime
 
    if ($null -eq $lastActivity -and $null -eq $created) {
        Write-Warning ("Skipped {0}: no sign-in activity and no createdDateTime." -f $guest.Id)
        continue
    }
 
    $reference = if ($null -ne $lastActivity) { [datetime]$lastActivity } else { [datetime]$created }
    if ($reference -ge $cutoff) {
        continue
    }
 
    [void]$inactive.Add([pscustomobject]@{
        Id                 = $guest.Id
        UserPrincipalName  = $guest.UserPrincipalName
        DisplayName        = $guest.DisplayName
        AccountEnabled     = $guest.AccountEnabled
        LastActivityUtc    = if ($null -ne $lastActivity) { $reference.ToUniversalTime().ToString('o') } else { 'never' }
        CreatedDateTimeUtc = if ($null -ne $created) { ([datetime]$created).ToUniversalTime().ToString('o') } else { '' }
    })
}
 
$revoked = [System.Collections.Generic.List[object]]::new()
foreach ($guest in $inactive) {
    $result = Revoke-MgUserSignInSession -UserId $guest.Id
    if ($result -eq $false) {
        Write-Warning ("Refresh token revocation was not confirmed for {0}." -f $guest.UserPrincipalName)
        continue
    }
    [void]$revoked.Add($guest)
}
 
$revoked | Export-Csv -Path './inactive-guests-revoked.csv' -NoTypeInformation -Encoding utf8
Write-Output ("Scanned {0} guests. Revoked refresh tokens for {1} accounts inactive since {2:u}." -f $guestCount, $revoked.Count, $cutoff)