Entra ID Groups with Disabled Members

The question it answers: Which groups still have disabled accounts among their direct members, and which ones?

Note

Groups with at least one direct member whose account is disabled; only those members are listed per group.

At a glance

Where in the app	Entra ID › Groups › Groups With Disabled Members
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	No extra licence needed.
Report id (API and MCP)	entra.groups.disabled-members

Columns

Column	Key	Type
Display Name	DisplayName	Text
Description	Description	Text
Disabled Member Count	Members.Count	Number
Disabled Members	Members	Text
Expiration Date Time	ExpirationDateTime	DateTime
Security Group	SecurityEnabled	YesNo
Synchronised	OnPremisesSyncEnabled	YesNo
Membership Rule	MembershipRule	Text

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
Group.Read.All	Microsoft Graph	Read all groups

Data sources it reads

• GET /v1.0/users
• GET /v1.0/groups?$expand=members
• GET /v1.0/groups?$expand=owners

Through the API and MCP

GET /ir-api/v1/reports/entra.groups.disabled-members?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.groups.disabled-members. The client needs the Read grant for Entra ID. See Using the API.