Leaver Clean-up Completeness

The question it answers: Which disabled member accounts still hold admin roles, licences, group or app ownership, or Intune devices?

Disabling the account is only the first step of an off-boarding. Disabled users who still hold admin roles, paid licences, sole ownership of teams and groups, app registrations or devices are the leftovers - listed with what exactly remains.

Note

Mailbox delegates and forwarding: see Mailbox Delegation. OneDrive hand-over: see Orphaned OneDrives of Leavers. Disabled accounts that are shared or resource mailboxes on purpose appear too.

At a glance

Where in the app	Entra ID › Identity Lifecycle › Leaver Clean-up
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	None; the device check needs Microsoft Intune and the last sign-in column Microsoft Entra ID P1.
Report id (API and MCP)	entra.lifecycle.leaver-cleanup

Columns

Column	Key	Type
User	DisplayName	Link
Still holds	Findings	Status
Roles	Roles	Text
Licences	Licences	Text
Groups owned	GroupsOwned	Text
Apps owned	AppsOwned	Text
Devices	Devices	Text
Last sign-in	LastSignIn	Date
Department	Department	Text

What it needs

Licence: None; the device check needs Microsoft Intune and the last sign-in column Microsoft Entra ID P1.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
Group.Read.All	Microsoft Graph	Read all groups
Application.Read.All	Microsoft Graph	Read all applications
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices

Data sources it reads

• GET /v1.0/users (accountEnabled, assignedLicenses)
• GET /v1.0/roleManagement/directory/roleAssignments
• GET /v1.0/groups?$expand=owners
• GET /v1.0/applications?$expand=owners
• GET /beta/deviceManagement/managedDevices

Through the API and MCP

GET /ir-api/v1/reports/entra.lifecycle.leaver-cleanup?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.lifecycle.leaver-cleanup. The client needs the Read grant for Entra ID. See Using the API.