Identity Lifecycle — Guest Cleanup and Account Expiry for Microsoft Entra ID

GUEST CLEANUP

Every external partner, vendor, or consultant you invite becomes a guest account that lives forever. Identity Lifecycle finds guests that have not signed in for a configurable number of days, emails the report to your Teams channel, disables them after a grace period, and (optionally) deletes them after a further period. Warn, disable, and delete stages are tracked so nobody is surprised.

ACCOUNT EXPIRY

On-premises Active Directory always let you set an account to expire on a date. Cloud-only Entra accounts have no equivalent (a 1,545-vote, nine-year-old Azure request). Set the standard employeeLeaveDateTime attribute on any contractor, temp, or intern; Identity Lifecycle warns at 14, 7, and 1 days and disables the account the day after it expires.

WHO IT IS FOR

IT and identity teams, MSPs, and any organization with external collaborators or fixed-term staff that needs to prove no forgotten accounts can sign in.

WHY IT IS SAFE

No vendor backend. It runs on a consumption Function in your own tenant with a managed identity you control, and posts only to the Teams webhook you configure. It ships in DRY RUN mode — reports only, no changes — until you switch enforcement on.

SETUP

Deploy from the marketplace, paste a Teams webhook, and run one script to grant the managed identity its Microsoft Graph roles. Review the first reports, then set DRY_RUN=false.