Inactive Entra ID Users

The question it answers: Which enabled accounts have not signed in for longer than the inactivity threshold, or never?

Enabled accounts whose most recent sign-in - interactive, non-interactive or successful - is older than the inactivity threshold (Settings > Report thresholds), or who never signed in. Accounts created within the threshold are left out.

Note

Counts interactive, non-interactive and successful sign-ins; the most recent of them decides. Accounts created within the threshold are left out (they have had no chance to sign in yet). Guests are listed only with the switch on.

At a glance

Where in the app	Entra ID › Users › Inactive Users
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (sign-in activity).
Report id (API and MCP)	entra.users.inactive
An empty result means	Every enabled member signed in within the inactivity threshold.

Columns

Column	Key	Type
Display Name	DisplayName	Text
User Principal Name	UserPrincipalName	Text
Type	UserType	Text
Last sign-in	LastSignIn	DateTime
Days since	DaysSince	Number

Filters

Filter	Key (API)	On when the page opens
Hide guests	hide-guests	Yes

What it needs

Licence: Microsoft Entra ID P1 (sign-in activity).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/users
• GET /v1.0/users?$select=signInActivity

Through the API and MCP

GET /ir-api/v1/reports/entra.users.inactive?size=100
GET /ir-api/v1/reports/entra.users.inactive?filter=hide-guests

An AI assistant reads it with the MCP tool get_report and the id entra.users.inactive. The client needs the Read grant for Entra ID. See Using the API.