Managing Guest Users in Entra ID with PowerShell
Canonical URL: https://learncloud.guru/blog/managing-guest-users-in-entra-id-with-powershell
Author: Junaid Ahmed
Published: 2025-02-24T18:40:20.000Z
Updated: 2026-10-25T17:16:08.227Z
Topics: Entra ID, PowerShell
Tags: Entra ID, Powershellscripting, Powershell

Why Do You Need This Script? Guest users in Entra ID (formerly Azure AD) are external users invited to collaborate within an organization. However, many guests:🔹 Never accept their invitations🔹 Stop using their accounts after a period of time🔹 Pose a security risk if their access isn’t revoked To maintain security and compliance, IT administrators …

Why Do You Need This Script?

Guest users in Entra ID (formerly Azure AD) are external users invited to collaborate within an organization. However, many guests:
🔹 Never accept their invitations
🔹 Stop using their accounts after a period of time
🔹 Pose a security risk if their access isn’t revoked

To maintain security and compliance, IT administrators must track and manage guest users regularly. Manually reviewing thousands of guest accounts is time-consuming and error-prone-that’s where PowerShell automation comes in.

This script provides:
✅ An export of all guest users
✅ A list of users who never accepted their invite
✅ A list of users who haven’t signed in for the last 30 days
✅ An option to delete inactive guest users in bulk

PowerShell Script to Manage Guest Users

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.Read.All", "Directory.ReadWrite.All"

# Define export location
$ExportPath = "C:\Entra ID\Guest Users"
If (!(Test-Path -Path $ExportPath)) { New-Item -ItemType Directory -Path $ExportPath }

# Function to write logs
Function Write-Log {
    param ([string]$message)
    $logFile = "$ExportPath\GuestUserLog.txt"
    "$((Get-Date).ToString('yyyy-MM-dd HH:mm:ss')) - $message" | Out-File -Append -FilePath $logFile
}

# Get all guest users
$GuestUsers = Get-MgUser -Filter "UserType eq 'Guest'" -All

# Export all guest users
$GuestUsers | Select-Object DisplayName, UserPrincipalName, CreatedDateTime, SignInActivity |
    Export-Csv -Path "$ExportPath\AllGuestUsers.csv" -NoTypeInformation

Write-Log "Exported all guest users."

# Find users who never accepted invites
$PendingInvites = $GuestUsers | Where-Object { $_.SignInActivity.LastSignInDateTime -eq $null }

# Export users who never accepted invites
$PendingInvites | Select-Object DisplayName, UserPrincipalName |
    Export-Csv -Path "$ExportPath\PendingInvites.csv" -NoTypeInformation

Write-Log "Exported guest users who never accepted invites."

# Find users who haven’t signed in for 30 days
$InactiveUsers = $GuestUsers | Where-Object { $_.SignInActivity.LastSignInDateTime -lt (Get-Date).AddDays(-30) }

# Export inactive users
$InactiveUsers | Select-Object DisplayName, UserPrincipalName, LastSignInDateTime |
    Export-Csv -Path "$ExportPath\InactiveUsers.csv" -NoTypeInformation

Write-Log "Exported guest users who have not signed in for 30 days."

# Delete inactive users
Function Delete-Users {
    param ($csvFile)
    $UsersToDelete = Import-Csv -Path $csvFile
    foreach ($user in $UsersToDelete) {
        try {
            Remove-MgUser -UserId $user.UserPrincipalName -Confirm:$false
            Write-Log "Deleted user: $($user.UserPrincipalName)"
        } catch {
            Write-Log "Error deleting user: $($_.Exception.Message)"
        }
    }
}

# Provide options to the admin
Write-Host "Select an option: `n1. Export all guest users`n2. Export users who never accepted invites`n3. Export inactive users (30+ days)`n4. Delete inactive users"
$choice = Read-Host "Enter choice (1-4)"
Switch ($choice) {
    1 { Invoke-Item "$ExportPath\AllGuestUsers.csv" }
    2 { Invoke-Item "$ExportPath\PendingInvites.csv" }
    3 { Invoke-Item "$ExportPath\InactiveUsers.csv" }
    4 { Delete-Users "$ExportPath\InactiveUsers.csv" }
}

Disconnect-MgGraph

Benefits of This Script

🔹 Security: Reduces stale guest accounts that may pose a risk.
🔹 Compliance: Ensures only active users have access.
🔹 Efficiency: Automates guest user management, saving hours of manual work.

This script helps organizations clean up inactive guest users, track pending invites, and remove security risks automatically. 🚀