Inactive Enterprise Apps & Stale Service Principals

The question it answers: Which enterprise apps have not signed in for 90 days or more, and which of them still hold valid credentials?

Apps that nobody signs in to any more but that still hold permissions - and often a valid secret or certificate - are free persistence for an attacker. Apps with active credentials and no recent sign-in are listed first.

Note

Microsoft first-party apps and managed identities are left out. ‘No sign-in recorded’ can also mean the app has not signed in since Microsoft started collecting this data.

At a glance

Where in the app	Entra ID › Security › Inactive Enterprise Apps
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 for service principal sign-in activity.
Report id (API and MCP)	entra.security.inactive-apps

Columns

Column	Key	Type
App	DisplayName	Link
Activity	ActivityState	Status
Last sign-in	LastSignIn	Date
Last app-only	LastAppOnlySignIn	Date
Last delegated	LastDelegatedSignIn	Date
Valid credentials	ActiveCredentialCount	Text
Origin	Origin	Text
App ID	AppId	Text

Filters

Filter	Key (API)	On when the page opens
Only inactive apps	inactive	Yes
Only apps registered in this tenant	own	No

What it needs

Licence: Microsoft Entra ID P1 for service principal sign-in activity.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Application.Read.All	Microsoft Graph	Read all applications
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/servicePrincipals
• GET /beta/reports/servicePrincipalSignInActivities
• GET /v1.0/applications + /servicePrincipals (credentials, shared with App Credential Expiry)

Through the API and MCP

GET /ir-api/v1/reports/entra.security.inactive-apps?size=100
GET /ir-api/v1/reports/entra.security.inactive-apps?filter=inactive

An AI assistant reads it with the MCP tool get_report and the id entra.security.inactive-apps. The client needs the Read grant for Entra ID. See Using the API.