Entra stale-guest lifecycle automation

I published a PowerShell runbook for reviewing and removing unused Entra guest accounts. It previews candidates, disables accounts before deletion, and gives administrators time to restore legitimate access.

Cleanup controls

• Report-only by default. Discovery and review are the normal path. State changes must be chosen explicitly.
• Disable before delete. The lifecycle creates a recovery window instead of turning the first cleanup pass into permanent removal.
• Managed identity. Microsoft Graph access runs without a stored client secret to rotate.
• Limits on changes. Exclusions, privileged-role skipping, per-run caps, and an anomaly threshold stop a surprising candidate set before anything changes.
• Automated tests. Pester covers discovery, eligibility, action gating, and the guardrails around state changes.

Setup and testing

The public repository includes automated Pester tests, deployment instructions, and the required Microsoft Graph permissions. It is a reference runbook to configure for each tenant.