Inactive SharePoint Users (90 days)

The question it answers: Which users have not accessed a SharePoint file or site in the last 90 days?

Note

Users come from GET /users (all pages). Activity is the newest FileAccessed / SiteAccessed audit record of the last 90 days, matched to the UPN in any case; users with none are listed. At most 500,000 audit records are read.

At a glance

Where in the app	SharePoint Online › Sites › Inactive Users
Workload	SharePoint Online
Kind	Table
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan.
Licence	Microsoft Purview Audit (Standard) - included in Microsoft 365 E3 / Business Premium; unified audit logging must be on.
Report id (API and MCP)	sharepoint.users.inactive

Columns

Column	Key	Type
Last activity	LastActivityFormatted	Text
User	Id	Text

What it needs

Licence: Microsoft Purview Audit (Standard) - included in Microsoft 365 E3 / Business Premium; unified audit logging must be on.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
AuditLogsQuery.Read.All	Microsoft Graph	Read audit logs data from all services

Data sources it reads

• GET /v1.0/users (all pages)
• POST /v1.0/security/auditLog/queries (FileAccessed, SiteAccessed, last 90 days)
• GET /v1.0/security/auditLog/queries/{id}
• GET /v1.0/security/auditLog/queries/{id}/records

Through the API and MCP

GET /ir-api/v1/reports/sharepoint.users.inactive?size=100
POST /ir-api/v1/reports/sharepoint.users.inactive/scan

An AI assistant reads it with the MCP tool get_report and the id sharepoint.users.inactive. The client needs the Run scan grant for SharePoint Online. See Using the API.