Access Reviews and Identity Hygiene

Connect-MgGraph -Scopes 'AccessReview.ReadWrite.All','User.ReadWrite.All',
  'RoleManagement.Read.Directory','AuditLog.Read.All','Directory.Read.All' -NoWelcome

$props = 'id','displayName','userPrincipalName','accountEnabled',
         'userType','createdDateTime','signInActivity','externalUserState'
$users = Get-MgUser -All -Property $props
$cutoff = (Get-Date).AddDays(-90)

$dormant = $users | Where-Object {
  $_.AccountEnabled -and $_.UserType -eq 'Member' -and
  ($null -eq $_.SignInActivity.LastSignInDateTime -or $_.SignInActivity.LastSignInDateTime -lt $cutoff)
}
$staleGuests = $users | Where-Object {
  $_.UserType -eq 'Guest' -and
  ($null -eq $_.SignInActivity.LastSignInDateTime -or $_.SignInActivity.LastSignInDateTime -lt $cutoff)
}
$pendingGuests = $users | Where-Object { $_.ExternalUserState -eq 'PendingAcceptance' }

"Dormant members (90d+): $($dormant.Count)"
"Stale guests (90d+)   : $($staleGuests.Count)"
"Guests never accepted : $($pendingGuests.Count)"

# entra.microsoft.com > ID Governance > Access reviews > New access review.
#
#   Select what to review = Microsoft Entra roles
#   Role = User Administrator
#   Assignment type = Eligible assignments (recertify the PIM eligibility)
#   Reviewers = Selected reviewers (a security manager), or 'Self-review' for attestation
#   Duration = 7 days,  Recurrence = Quarterly
#   Upon completion:
#     Auto apply results = Enable
#     If reviewers don't respond = Remove access
#     Require justification = Yes
#     Show recommendations (based on sign-in) = Yes
#
# Read your review definitions back via Graph:
Get-MgIdentityGovernanceAccessReviewDefinition |
  Select-Object Id, DisplayName, Status | Format-Table -AutoSize

# Target group holding external collaborators (create or reuse one).
$grp = New-MgGroup -DisplayName 'Northgate-External-Collab' -MailEnabled:$false `
  -MailNickname 'northgate-ext-collab' -SecurityEnabled:$true
$reviewer = Get-MgUser -Filter "userPrincipalName eq 'lokafor@$((Get-MgOrganization).VerifiedDomains | Where-Object IsDefault | Select-Object -ExpandProperty Name)'"

$review = @{
  displayName = 'Quarterly guest access review - external collaboration'
  descriptionForAdmins = 'Recertify external guest membership of the collaboration group'
  descriptionForReviewers = 'Confirm each external guest still needs access. Deny to remove.'
  scope = @{
    '@odata.type' = '#microsoft.graph.accessReviewQueryScope'
    query = "/groups/$($grp.Id)/transitiveMembers/microsoft.graph.user/?`$filter=(userType eq 'Guest')"
    queryType = 'MicrosoftGraph'
  }
  reviewers = @(@{ query = "/users/$($reviewer.Id)"; queryType = 'MicrosoftGraph' })
  settings = @{
    mailNotificationsEnabled = $true
    reminderNotificationsEnabled = $true
    justificationRequiredOnApproval = $true
    recommendationsEnabled = $true
    defaultDecisionEnabled = $true
    defaultDecision = 'Deny'               # no response = remove access
    instanceDurationInDays = 7
    autoApplyDecisionsEnabled = $true      # actually remove denied access
    recurrence = @{
      pattern = @{ type = 'absoluteMonthly'; interval = 3; dayOfMonth = 1 }
      range   = @{ type = 'noEnd'; startDate = (Get-Date).ToString('yyyy-MM-dd') }
    }
  }
}

New-MgIdentityGovernanceAccessReviewDefinition -BodyParameter $review

# Define conflicting role pairs and why each pair is toxic.
$conflicts = @(
  @{ A='User Administrator';        B='Privileged Role Administrator'; Why='Create accounts AND grant them privileged roles' },
  @{ A='Application Administrator'; B='Privileged Role Administrator'; Why='Add app credentials AND escalate app privilege' },
  @{ A='Helpdesk Administrator';    B='Privileged Role Administrator'; Why='Reset admin passwords AND grant roles' }
)

# Build a map of user -> set of role names from active assignments.
$userRoles = @{}
foreach ($role in (Get-MgDirectoryRole -All)) {
  foreach ($m in (Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All)) {
    $upn = $m.AdditionalProperties['userPrincipalName']
    if (-not $upn) { continue }
    if (-not $userRoles.ContainsKey($upn)) { $userRoles[$upn] = @() }
    $userRoles[$upn] += $role.DisplayName
  }
}

# Flag anyone holding both roles of any conflict pair.
$findings = foreach ($upn in $userRoles.Keys) {
  foreach ($c in $conflicts) {
    if (($userRoles[$upn] -contains $c.A) -and ($userRoles[$upn] -contains $c.B)) {
      [pscustomobject]@{ User=$upn; Conflict="$($c.A) + $($c.B)"; Why=$c.Why }
    }
  }
}
$findings | Format-Table -AutoSize
$findings | Export-Csv "sod-conflicts-$(Get-Date -f yyyyMMdd).csv" -NoTypeInformation

# Disable (not delete) dormant members first: reversible, with a retention window.
foreach ($u in $dormant) {
  Update-MgUser -UserId $u.Id -AccountEnabled:$false
  Write-Host "Disabled dormant member: $($u.UserPrincipalName)"
}

# Remove guests with no sign-in in 90 days and no pending invite.
# For guests, removal is usually appropriate as they are external.
foreach ($g in $staleGuests) {
  Remove-MgUser -UserId $g.Id
  Write-Host "Removed stale guest: $($g.UserPrincipalName)"
}

# Lifecycle Workflows (Entra ID Governance) automate joiner-mover-leaver.
# For leavers, a scheduled workflow triggered on the employee leave date can:
#   - disable the account
#   - remove it from all groups and Teams
#   - remove licences
#   - revoke sessions
#
# Configure at: entra.microsoft.com > ID Governance > Lifecycle Workflows >
#   Create a workflow > 'Real-time employee termination' or 'Leaver' template.
# This removes the manual dormancy sweep for staff who leave properly,
# leaving your Phase A query to catch only the exceptions.