Guest Lifecycle

The question it answers: Which guest accounts are stale or never used, and how much can they still reach through group membership?

Every guest account with how long it has existed, when it was last used, and how much it can still reach through group and team membership. Built from cached users, groups and sign-in activity.

Note

No Graph call is made when you open this page - it is a join over data already in the cache.

At a glance

Where in the app	Entra ID › Users › Guest Lifecycle
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 - required for sign-in activity. Without it guests are still listed, but ‘last activity’ and the stale buckets stay empty.
Report id (API and MCP)	entra.users.stale-guests

Columns

Column	Key	Type
Display Name	DisplayName	Link
User Principal Name	UserPrincipalName	Text
External domain	ExternalDomain	Text
State	StaleState	Status
Invite state	ExternalUserState	Text
Age (days)	AgeInDays	Text
Last activity	LastActivityDateTime	Date
Groups	GroupMembershipCount	Text
Group names	GroupNamesString	Text

Filters

Filter	Key (API)	On when the page opens
Show only stale guests	stale	No
Show only guests with group access	with-access	No

What it needs

Licence: Microsoft Entra ID P1 - required for sign-in activity. Without it guests are still listed, but ‘last activity’ and the stale buckets stay empty.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLog.Read.All	Microsoft Graph	Read all audit log data
Directory.Read.All	Microsoft Graph	Read directory data
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
Group.Read.All	Microsoft Graph	Read all groups

Data sources it reads

• GET /v1.0/users?$select=signInActivity
• GET /v1.0/groups

Through the API and MCP

GET /ir-api/v1/reports/entra.users.stale-guests?size=100
GET /ir-api/v1/reports/entra.users.stale-guests?filter=stale

An AI assistant reads it with the MCP tool get_report and the id entra.users.stale-guests. The client needs the Read grant for Entra ID. See Using the API.