Entra stale-guest lifecycle automation

External guest identities can outlive their owners or business purpose, but deleting them from a tenant without a review window can break legitimate partner access. I published a tenant-neutral PowerShell runbook that makes cleanup staged, observable, and reversible before anything becomes permanent.

Safety is the design

• Report-only by default. Discovery and review are the normal path. State changes must be chosen explicitly.
• Disable before delete. The lifecycle creates a recovery window instead of turning the first cleanup pass into permanent removal.
• Managed identity. Microsoft Graph access runs without a stored client secret that somebody must rotate or eventually discover has expired.
• Blast-radius controls. Exclusions, privileged-role skipping, per-run caps, and an anomaly threshold stop a surprising candidate set before it becomes an incident.
• Automated tests. Pester covers discovery, eligibility, action gating, and the guardrails around state changes.

Deployment posture

The repository is built and tested as a public reference with deployment instructions and required Graph permissions. It does not claim that the public runbook is deployed in a production tenant. That distinction is deliberate: readable code proves the engineering, while deployment status remains exactly what the evidence supports.