Rules/STALE-002.no-never-signed-in-guests.psd1
|
@{ Id = 'STALE-002' Title = 'No guest accounts that never signed in' Area = 'StaleAccounts' Severity = 'Low' References = @( 'https://learn.microsoft.com/entra/identity/users/clean-up-stale-guest-accounts' ) Rationale = 'Invited guests who never accepted or never signed in are directory clutter with standing (if unused) access grants - typical audit findings.' Remediation = 'Remove guests that never signed in, or re-invite them deliberately if the collaboration is still wanted.' Test = { param($Snapshot) $staleData = $Snapshot.StaleAccounts $guestCount = [int]$staleData.summary.neverSignedInGuestCount if ($guestCount -eq 0) { New-TLRuleResult -Status Pass -Evidence 'Every guest account has signed in at least once.' } else { $examples = @($staleData.users | Where-Object { $_._tlNeverSignedInGuest } | Select-Object -First 10 | ForEach-Object { $_.userPrincipalName }) New-TLRuleResult -Status Fail -Evidence (@("{0} guest account(s) never signed in." -f $guestCount) + $examples) } } } |