get-O365InactiveUsers.ps1

<#PSScriptInfo
.VERSION 2.0
.GUID ed277db7-b089-48db-b1ee-6297160d647d
.AUTHOR
 Maarten Peeters - Cloud Securitea - https://www.cloudsecuritea.com
.COMPANYNAME
 Cloud Securitea
.COPYRIGHT
.TAGS
 office365, inactive users, audit,AAD,Azure Active Directory
.LICENSEURI
.PROJECTURI
.ICONURI
.EXTERNALMODULEDEPENDENCIES
 MSOnline
.RELEASENOTES
 Version 1.0: Original published version.
 Version 2.0: Updated a few comment sections.
#>
 

<#
.SYNOPSIS
 Quickly generate an overview of inactive users based on Office 365 audit logs
 
.DESCRIPTION
 This script will generate a HTML file to list all inactive users and the last logon of users based on the audit log.
 Inactive users will normally be collected using the users mailbox but external and users without a license don't have a mailbox.
 We will be using the audit log to find successful and failed logons for internal users and page viewes for external users.
 It will take around 6-8 seconds per user as we are querying the log for each user.
 
.PARAMETER LogPath
 Enter the full path to store the HTML report of the Office 365 inactive users
 For example: C:\Install
 
.EXAMPLE
 Get-InactiveUsers.ps1 -LogPath "C:\Install" -days 90
 
 .NOTES
 Version: 2.0
 Author: Maarten Peeters
 Creation Date: 18-09-2019
 Purpose/Change: Quickly generate an overview of inactive users based on the audit log
#>


param(
    [Parameter(mandatory=$true)]
    [string] $LogPath,
    [Parameter(mandatory=$true)]
    [int] $days
)

try{
    #Verify if MSOnline Module is available
    if (Get-Module -ListAvailable -Name MSonline) {
        #Import MSOnline Module
        import-module MSOnline -ErrorAction SilentlyContinue

        #Verify if the New Exchange Online Module is installed
        try{
            $file = Get-ChildItem -Path $("$($env:LOCALAPPDATA)\Apps\2.0\") -Filter Microsoft.Exchange.Management.ExoPowershellModule.dll -Recurse

            #Test if logpath exists
            If(Test-Path $LogPath) { 
                #Start script
                Try{
                    #Object collections
                    $userCollection = @()

                    #Connect to the correct O365 Tenant
                    Connect-MsolService

                    #Connect to the Exchange Online
                    Import-Module $((Get-ChildItem -Path $("$($env:LOCALAPPDATA)\Apps\2.0\") -Filter Microsoft.Exchange.Management.ExoPowershellModule.dll -Recurse ).FullName|?{$_ -notmatch "_none_"}|select -First 1)
                    $EXOSession = New-ExoPSSession 
                    Import-PSSession $EXOSession -allowclobber | out-null
                    
                    #Retrieve all users and order them by UPN
                    $users = Get-MsolUser -All | Select-Object UserPrincipalName, isLicensed, DisplayName, WhenCreated | Sort-Object UserPrincipalName
                    write-host "There are currently $($users.count) users in the AAD" -foregroundcolor cyan

                    #prepare the dates
                    $enddate = get-date
                    $startdate = $enddate.AddDays( 0 - $days )
                    
                    #loop through all users to get the latest logondate
                    $i = 1
                    foreach ($user in $users){
                        write-host "Processing user $($i) - $($user.UserPrincipalName)" -foregroundcolor white

                        #clear variables
                        $convertedoutput = $null

                        #Create unique session name for the audit log query
                        $sessionName = $user.UserPrincipalName

                        $j = 0
                        Do {
                            #search the audit log differently for externals as I couldn't see successful or failed logons
                            if ($user.UserPrincipalName -like "*#EXT#@*"){
                                $AuditOutput = Search-UnifiedAuditLog -StartDate $startdate -EndDate $enddate -UserIds $user.UserPrincipalName -SessionId $sessionName -SessionCommand ReturnLargeSet -Operations PageViewed -ResultSize 5000
                            }
                            else{
                                $AuditOutput = Search-UnifiedAuditLog -StartDate $startdate -EndDate $enddate -UserIds $user.UserPrincipalName -SessionId $sessionName -SessionCommand ReturnLargeSet -Operations UserLoggedIn, UserLoginFailed -ResultSize 5000
                            }
                        
                            # If the count is 0, no records to process
                            if ($AuditOutput.Count -gt 0) {
                                #Get the data
                                $ConvertedOutput = $AuditOutput | Select-Object CreationDate, operations

                                if ($AuditOutput.Count -lt 5000) {
                                    $AuditOutput = @()
                                } else {
                                    $j++
                                }
                            }
                        } Until ($AuditOutput.Count -eq 0)

                        #The user is very active if the limit has been reached. This doesn't matter for this script but it will take more time.
                        if ($ConvertedOutput.Count -ge 50000) {
                            write-host "To many logins for user $($user.UserPrincipalName), it has been actively used" -foregroundcolor yellow
                        }

                        # Get the latest login date, latest operation and the number of days since the last action
                        if ( $ConvertedOutput.Count -gt 0 ) {
                            $logon = ($ConvertedOutput | Sort-Object CreationDate | Select-Object -last 1 -Property CreationDate).CreationDate
                            $operations = ($ConvertedOutput | Sort-Object CreationDate | Select-Object -last 1 -Property operations).operations
                            $timespan = New-TimeSpan -Start $logon -End $enddate
                            $daysLastLoggedOn = $timespan.days
                        } else {
                            $logon = $null
                            $timespan = $null
                            $operations = $null
                            $daysLastLoggedOn = "$($days)+"
                        }
                        
                        #place the user in the collection
                        $userCollection += new-object psobject -property @{UserPrincipalName = $user.UserPrincipalName;LastLogonTimestamp = $logon;CreationDate = $user.WhenCreated;LogonCount = $ConvertedOutput.Count;isLicensed = $user.isLicensed;DisplayName = $user.DisplayName;DaysLastLoggedOn = $daysLastLoggedOn;Status = $operations}
                        
                        $i++
                    }

                    #sort output
                    $loggedOnUsers = $userCollection | Where-Object { $_.LogonCount -gt 0 }
                    $inactiveUsers = $userCollection | Where-Object { $_.LogonCount -eq 0 }

                    #We now have our collections so we are building the HTML page to get a direct view
                    #List of all inactive users
                    $article = "<h2>List of all inactive users</h2>"
                    $article += "<table>
                                <tr>
                                    <th>UPN</th>
                                    <th>Created</th>
                                    <th>DisplayName</th>
                                    <th>isLicensed</th>
                                    <th>Amount of logons</th>
                                    <th>Last logon timestamp</th>
                                    <th>days ago</th>
                                    <th>Status</th>
                                </tr>"

                    
                    foreach($inactiveUser in $inactiveUsers){
                    $article += "<tr>
                                    <td>$($inactiveUser.UserPrincipalName)</td>
                                    <td>$($inactiveUser.CreationDate)</td>
                                    <td>$($inactiveUser.DisplayName)</td>
                                    <td>$($inactiveUser.isLicensed)</td>
                                    <td>$($inactiveUser.LogonCount)</td>
                                    <td>$($inactiveUser.LastLogonTimestamp)</td>
                                    <td>$($inactiveUser.DaysLastLoggedOn)</td>
                                    <td>$($inactiveUser.Status)</td>
                                </tr>"

                    }
                    
                    $article += "</table>"

                    #List of all active users
                    $article += "<h2>List of all active users</h2>"
                    $article += "<table>
                                <tr>
                                    <th>UPN</th>
                                    <th>Created</th>
                                    <th>DisplayName</th>
                                    <th>isLicensed</th>
                                    <th>Amount of logons</th>
                                    <th>Last logon timestamp</th>
                                    <th>days ago</th>
                                    <th>Status</th>
                                </tr>"

                    
                    foreach($loggedonuser in $loggedonusers){
                    $article += "<tr>
                                    <td>$($loggedonuser.UserPrincipalName)</td>
                                    <td>$($loggedonuser.CreationDate)</td>
                                    <td>$($loggedonuser.DisplayName)</td>
                                    <td>$($loggedonuser.isLicensed)</td>
                                    <td>$($loggedonuser.LogonCount)</td>
                                    <td>$($loggedonuser.LastLogonTimestamp)</td>
                                    <td>$($loggedonuser.DaysLastLoggedOn)</td>
                                    <td>$($loggedonuser.Status)</td>
                                </tr>"

                    }
                    
                    $article += "</table>"

                    $date = get-date
                    $today = $date.ToString("ddMMyyyy_HHmm")
                    $LogPath = Join-Path $LogPath "HTMLInactiveUserReport_$($today).html"    
                    
                    #Head
                    $head = "
                    <html xmlns=`"http://www.w3.org/1999/xhtml`">
                        <head>
                            <style>
                                @charset `"UTF-8`";
 
                                @media print {
                                    body {-webkit-print-color-adjust: exact;}
                                }
                     
                                div.container {
                                    width: 100%;
                                    border: 1px solid gray;
                                }
                                 
                                header {
                                    padding: 0.1em;
                                    color: white;
                                    background-color: #000033;
                                    color: white;
                                    clear: left;
                                    text-align: center;
                                    border-bottom: 2px solid #FF0066
                                }
                                 
                                footer {
                                    padding: 0.1em;
                                    color: white;
                                    background-color: #000033;
                                    color: white;
                                    clear: left;
                                    text-align: center;
                                    border-top: 2px solid #FF0066
                                }
 
                                article {
                                    margin-left: 20px;
                                    min-width:600px;
                                    min-height: 600px;
                                    padding: 1em;
                                }
                                 
                                th{
                                    border:1px Solid Black;
                                    border-Collapse:collapse;
                                    background-color:#000033;
                                    color:white;
                                }
                                 
                                th{
                                    border:1px Solid Black;
                                    border-Collapse:collapse;
                                }
 
                            </style>
                        </head>
                    "

                    
                    #Header
                    $date = (get-date).tostring("dd-MM-yyyy")
                    $header = "
                        <h1>Inactive users Report</h1>
                        <h5>$($date)</h5>
                    "

                    
                    #Footer
                    $Footer = "
                        Copyright &copy;
                    "

                    
                    #Full HTML
                    $HTML = "
                        $($Head)
                        <body class=`"Inventory`">
                            <div class=`"container`">
                                <header>
                                    $($Header)
                                </header>
                                 
                                <article>
                                    $($article)
                                </article>
                                         
                                <footer>
                                    $($footer)
                                </footer>
                            </div>
                        </body>
                        </html>
                    "
 
                    add-content $HTML -path $LogPath

                    Write-Host "Office 365 inactive users overview created at $($LogPath), it will also open automatically in 5 seconds" -foregroundcolor green

                    Remove-PSSession $EXOSession

                    start-sleep -s 5
                    Invoke-Item $LogPath
                }
                catch{
                    write-host "Error occurred: $($_.Exception.Message), please post this error on https://www.cloudsecuritea.com" -foregroundcolor red
                }
            } Else { 
                Write-Host "The path $($LogPath) could not be found. Please enter a correct path to store the Office 365 subscription and license overview" -foregroundcolor yellow
            }
        }
        catch{Write-Host "The new Exchange Online module is not installed. Please install using the link in the blog" -foregroundcolor yellow}
    } else {
        Write-Host "MSOnline module not loaded. Please install the MSOnline module with Install-Module MSOnline" -foregroundcolor yellow
    }
}
catch{
    write-host "Error occurred: $($_.Exception.Message)" -foregroundcolor red
}