Microsoft 365 Inventory Risk Views: Find Inactive Users, Ownerless Groups and Dormant Guests

Most Microsoft 365 hardening advice starts with settings: which policy to enable, which toggle to flip. A second class of risk has nothing to do with settings. It is the accumulated state of your directory: accounts nobody uses, guests who were invited and never arrived, groups with no one responsible for them, and app credentials that quietly expired. A benchmark scan will not list these, because they are not configuration. You find them by looking at the objects.

Why directory hygiene is its own problem

Every dormant object is access that nobody is watching. An account that has not signed in for months still holds licences, group memberships and possibly roles. A guest who never accepted an invitation still sits in the directory. A group with no owner has no one to approve membership changes or remove stale members.

The difficulty is not understanding this. It is seeing it: the Microsoft 365 admin centers are organised around creating and editing objects, not around asking "which of these look wrong?". Answering that question across users, guests, groups, apps and devices usually means exporting several lists and cross-referencing them by hand.

One inventory, with the risk views built in

ConfigCobra's Inventory & Insights module collects the objects in your tenant into a single inventory and ships with risk views that answer those questions directly. For Microsoft 365 the inventory covers users, guests, admins, groups, devices, enterprise apps (service principals), app registrations, mailboxes, SharePoint sites, Conditional Access and other policies, domains, licences and directory roles. The connection uses read-only Microsoft Graph permissions.

The built-in risk views include:

• Users inactive 90 days
• Users who never signed in
• Users with no MFA registered
• Guests who never signed in
• Groups without owner
• External mail forwarding
• Unmanaged / non-compliant devices
• High-privilege app permissions
• Expired or soon-expiring app credentials
• Unused paid licences
• Conditional Access policies not enforced
• Sites allowing "Anyone" links
• Domains without DKIM / DMARC

Each one has its own page in the insights library, explaining the problem and what to do about it.

Reading the identity views together

The views are most useful in combination, because the same object often shows up in more than one.

Inactive users and users who never signed in

These look similar but call for different follow-up. An account that was active and then went quiet usually belongs to someone who left or changed role; the question is whether offboarding missed it. An account that never signed in at all was created and never used, which points at a provisioning process rather than an offboarding one. Treating them as one list hides that distinction.

Guests who never signed in

External guests are easy to create and rarely reviewed. A guest who has never signed in is an invitation that was never accepted, or an account created for a project that finished. Reviewing this view regularly keeps the external footprint of the tenant tied to people you can still name a reason for.

Groups without owner

A Microsoft 365 group without an owner has no accountable person. Membership drifts, and access granted through the group (a Team, a SharePoint site, a licence assignment) persists with nobody asked to confirm it. Assigning an owner, or retiring the group, is a small change with a lasting effect.

No MFA registered and high-privilege app permissions

Two views sit closer to active risk than to housekeeping. Users with no MFA registered are the accounts a password-only attack reaches first. Apps with high-privilege permissions, and app credentials that have expired or are about to, are standing access that does not depend on a person signing in.

From a list to understanding: the relation graph

A list tells you that a group has no owner. It does not tell you what that group controls. The inventory's relation graph shows how objects connect: membership, ownership, roles, licences, mailbox delegation and Conditional Access scope. Starting from an ownerless group, you can see which members it has and what it is attached to, which turns "tidy this up" into a decision you can size.

Findings from your CIS assessment are also linked to the inventory objects they concern, so a failing control and the specific users, groups or policies behind it sit side by side rather than in separate tools. If you want to take a view elsewhere, for an access review or a ticket you raise yourself, the inventory supports CSV export.

Insight first, then fix, then check again

Inventory views show you where to look. Acting on them is a separate step you take in your own tenant, and ConfigCobra stays read-only throughout: it reads, it never changes anything. Pair the inventory with remediation impact analysis when a cleanup could affect people, so you know what an access change will do before you make it.

The same approach extends beyond Microsoft 365. Inventory is available for Azure, Google Cloud and AWS too, with a per-cloud view and an "All clouds" view, so the question "what do we have, and what looks wrong?" has one place to be asked.

See your own tenant's views

The quickest way to judge whether these views are useful is to see your own data in them. The 14-day free trial gives you full access to every available module, including Inventory & Insights, so you can connect a tenant and open the risk views the same day.