Users who never signed in

Microsoft describes obsolete user accounts as a security risk, and an account that was created but never used is one of the easiest to overlook. It can still hold group memberships and app access from the day it was provisioned.

Microsoft Learn notes that the last sign-in value can be blank if the account was never used for a sign-in attempt. That blank value is what this view looks for. It is also blank when the last attempt was before April 2020, which is why the script below also checks the creation date.

Sources: How to manage inactive user accounts (Microsoft Learn); signInActivity resource type (Microsoft Learn).

This script is read-only: it only reads user objects and their sign-in activity and writes a CSV file on your machine. It changes nothing in your tenant. Microsoft documents that reading sign-in activity needs a Microsoft Entra ID P1 or P2 licence, the AuditLog.Read.All and User.Read.All Graph permissions, and at least the Reports Reader role.

# Read-only: lists member users with no sign-in timestamp of any kind
Connect-MgGraph -Scopes 'AuditLog.Read.All','User.Read.All'

# Skip very new accounts that simply have not had time to sign in yet
$minAge = (Get-Date).AddDays(-14).ToUniversalTime()

Get-MgUser -All -Filter "userType eq 'Member'" `
    -Property Id,DisplayName,UserPrincipalName,AccountEnabled,CreatedDateTime,SignInActivity |
  Where-Object {
    $s = $_.SignInActivity
    -not $s.LastSignInDateTime -and
    -not $s.LastNonInteractiveSignInDateTime -and
    -not $s.LastSuccessfulSignInDateTime -and
    $_.CreatedDateTime -lt $minAge
  } |
  Select-Object DisplayName, UserPrincipalName, AccountEnabled, CreatedDateTime |
  Export-Csv .\users-never-signed-in.csv -NoTypeInformation

The 14-day grace period is an example value, not a Microsoft recommendation; set it to however long your onboarding normally takes.

Each row is a member account older than the grace period with no interactive, non-interactive or successful sign-in timestamp. Look at two columns first:

• CreatedDateTime: a long-ago creation date with no sign-in is the strongest signal that the account was provisioned and never used.
• AccountEnabled: an enabled account that has never been used is the one that can still be signed in to by someone.

Be careful with older accounts. Microsoft states that interactive sign-in data goes back to April 2020 and non-interactive data to May 2020, and that lastSuccessfulSignInDateTime was not backfilled (available from December 1, 2023). A blank value on an old account can therefore mean no activity in the retained window, not proof of no activity ever. Sign-in values can also take up to 24 hours to update.

Shared mailboxes, service-style accounts and break-glass accounts can legitimately show up here; identify them before treating a row as a problem.

For each account, ask the questions Microsoft Learn suggests: is the person still employed or expected, does the account still need the access it has, and is it needed for another reason? If the account was created for someone who never started, or for a project that never happened, remove its group memberships and app access and retire the account through your normal process.

If the account is expected but unused, ask the owner or manager to confirm it. Keep the CSV as a record of what you found and when. For guest accounts that never signed in, see the separate guest view and Microsoft's guidance on stale guest accounts.

ConfigCobra's Inventory & Insights includes a built-in risk view for users who never signed in, so you do not have to rerun a script. It is available on Microsoft 365, Azure, Google Cloud and AWS, with one inventory across clouds, findings linked to the inventory objects they concern, and CSV export. ConfigCobra stays read-only and never changes your tenant.