Comments on: Adding an Expiration Date for Entra ID Guest Accounts https://practical365.com/guest-account-expiration/ Practical Office 365 News, Tips, and Tutorials Mon, 03 Jun 2024 15:52:41 +0000 hourly 1 https://wordpress.org/?v=6.6.1 By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_294411'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_294411"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/guest-account-expiration/#comment-294411 Wed, 22 May 2024 13:23:48 +0000 https://practical365.com/?p=58402#comment-294411 In reply to Olek.

The code is written to illustrate a principle. After that, it’s up to you to change/develop the code to do what makes sense in your organization.

]]> By: Olek https://practical365.com/guest-account-expiration/#comment-294410 Wed, 22 May 2024 12:58:13 +0000 https://practical365.com/?p=58402#comment-294410 Hi,
Nice article.
I have one question. All your guest users are marked to expire in 365 days for the example.
For some users it could be good, for some not.
I see a problem when you have to invite some external user for a project work, it could be much more than 365 days.
So, after that date guest user will be disabled/removed. But even if we recover account it will be disabled again during the next script run as there is no procedure to prolong that expiration date, only manual intervention.

Thanks!

]]> By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_262022'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_262022"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/guest-account-expiration/#comment-262022 Fri, 05 May 2023 15:17:33 +0000 https://practical365.com/?p=58402#comment-262022 In reply to Tony M.

Guest accounts can be licensed. Have you tried assigning a license using the Microsoft 365 admin center or PowerShell?

]]> By: Tony M https://practical365.com/guest-account-expiration/#comment-262019 Fri, 05 May 2023 14:55:55 +0000 https://practical365.com/?p=58402#comment-262019 Cool workaround!

The issue that we mostly run into in terms of a Contractor is when they need to work on something specific that requires licensing. For example, PWA or Power BI Pro… Guest accounts can’t licensed from what I could see on my tenant. (Which is logical)

]]> By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_261972'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_261972"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/guest-account-expiration/#comment-261972 Fri, 05 May 2023 08:48:45 +0000 https://practical365.com/?p=58402#comment-261972 In reply to Tobias Plutat.

What events were you looking for in the event log? There have been some issues with searching the log in the past (and not finding events), but I think these problems have been squashed. At least, I haven’t heard of any lately (or encountered any).

There’s no doubt that Microsoft has work to do on Azure AD B2B Collaboration if they want people to use guest accounts more broadly. My hope is that by highlighting deficiencies, Microsoft might do something to fix the gaps.

As to developers using a guest account for DevOps, that sounds like a bridge too far…

]]> By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_261970'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_261970"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/guest-account-expiration/#comment-261970 Fri, 05 May 2023 08:42:17 +0000 https://practical365.com/?p=58402#comment-261970 In reply to Adam.

The GitHub link is there… Can you check again? (don’t know what happened).

]]> By: Tobias Plutat https://practical365.com/guest-account-expiration/#comment-261955 Fri, 05 May 2023 06:54:14 +0000 https://practical365.com/?p=58402#comment-261955 We implemented something similar, but ran into some “interesting” problems in practice:
– Currently, there seems to be no reliable way to check for non-interactive sign-ins (MSGraph doesn’t return this info properly). So unless there’s a conditional access policy that forces guest accounts to sign-in again periodically (and in shorter time intervals than the expiration period), there’s gonna be a significant rate of false-positives.
– We tried querying the audit log instead, but that turned out to not always report all activity (pretty shocking, if you ask me).

There’s always edge cases to consider, too – especially if AzureAD guest accounts are used in M365 tenants, but not to access M365 workloads. A client at my old company had contracted an external developer, who then used an AzureAD guest account in their tenant to access Azure Devops in the same tenant. He got blocked each and every time, no matter how often he logged in.

]]> By: Adam https://practical365.com/guest-account-expiration/#comment-261935 Fri, 05 May 2023 04:18:11 +0000 https://practical365.com/?p=58402#comment-261935 Hi Tony,

Great article (as usual). Microsoft should have account expiry for all accounts.

I was interested in having a look your script but noticed there isn’t a Github link for background job 2. Can you please provide this?

Thanks

]]>