During a recent audit we have been trying to automate a report on what Guest account’s are active in the last 30 days and to find what groups these guest account are members of so they can be removed if they are no longer required.
We could use AzureAD PowerShell for getting guest account and group membership but it was not that easy to automate this.
We decided to use Microsoft Graph as we have a few task already automated using Microsoft Graph and certificates so there is no need to hard code any password or application secret in my script.
I have done a previous post on the getting the access token and using certificate based authentication so if you need to know how to setup you can check that post.
Connect to Microsoft Graph using MSAL and Certificate based Authentication – TheSleepyAdmins
In this query we will be using three different Microsoft Graph url’s. First is to get a list of guest users, second will be to get sign-in logs and the last will be to get the guest users group membership.
To get guest users we will filtering using userType attribute
user resource type – Microsoft Graph v1.0 | Microsoft Docs
below are the permission that will be required
| Application | User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All |
To get sign-in’s we will be filtering on two different attributes (userPrincipalName & createdDateTime)
List signIns – Microsoft Graph v1.0 | Microsoft Docs
below are the permission that will be required
| Application | AuditLog.Read.All and Directory.Read.All |
To get Group membership we will be using the memberof
user: getMemberGroups – Microsoft Graph v1.0 | Microsoft Docs
below are the permission that will be required for getting the group membership.
| Application | User.Read.All, Directory.Read.All, Directory.ReadWrite.All |
First step as with any Graph query is to create the token request that will be used to access the different Graph Url’s. We will be using MSAL module and a certificate to generate.
To filer results using Graph we can put in ?filter= and then use a supported filter attribute. In this case we will be using usertype.
We will also create a blank array variable that will be used to output to later and a date variable to filer the sign-in logs.
This first filter will get all guest users. Currently usertype is only available when using the beta Graph version so we will be using that.
"https://graph.microsoft.com/beta/users/?filter=usertype eq 'Guest'"
Once we have the Guest users we will loop through each one, use a second filter that uses the mail address to filter the guest user sign-in logs and use a date variable to show only sign-in over the last 30 days.
"https://graph.microsoft.com/beta/auditLogs/signIns/?filter=userPrincipalName eq '$($User.mail)' and createdDateTime ge $Date"The next filter is going to use the user ID to get the memberof for the user and we will use the group-object to put all groups display names in to one object so it easier to call to the console windows or export to a CSV.
"https://graph.microsoft.com/beta/users/$($User.ID)/memberof"Once we have all the information returned from the Graph queries we need to format the results. For this we will use a hash table and an if statement to output user with or without sign-in logs to the correct hash table and add the values to the results variable.
This script is only going to return the latest sign-in log as I only really want to have a report that the users has been active in the last 30 day that’s why I am using [0] to select the latest object in the $logins variable.
The last part of the script just outputs the results and use select-object to format the order.
Now that we have the full script the below is what the result should look like.
To make the script more reusable there are three variable for TenantId , ClientId and CertThumprint.
To export the result to a csv instead of the console windows there is an -Exportpath parameter that just needs to have the path specified.
The full script can be download from my Github repository
Scripts/MSGraph/GuestUserAuditReport at master · TheSleepyAdmin/Scripts (github.com)
To filter on other attributes we can use the same process as above just change the Graph url and check the document for that url to view what is a valid filter attribute. Filtering results in the the Graph url speeds up the script and mean we don’t do addtional filtering after returning all data.
TheSleepyAdmins 