Azure Hygiene Automation

Automated User & Endpoint Inactivity Lifecycle Management

Technical Solution

The Automated Reporting Mechanism

Leveraging Azure Logic Apps and Microsoft Graph API to monitor Entra ID (Azure AD) and Intune activity.

Technical Architecture

The solution utilizes a serverless architecture to ensure zero maintenance and high reliability:

  • Trigger: Recurrence schedule (Every Monday, 08:00 AM).
  • Data Source: MS Graph signInActivity for users and managedDevices for endpoints.
  • Logic: Filter users where lastSignInDateTime > 14 days.
  • Delivery: HTML-formatted report sent via Outlook 365 or Microsoft Teams.

Sample Monday Morning Report

User Display Name Username (UPN) Last Log-In
John Doe j.doe@principality.co.uk 2026-03-10
Jane Smith j.smith@principality.co.uk 2026-02-28
Robert Brown r.brown@principality.co.uk 2026-01-15

Yellow: Inactive > 2 Weeks | Red: Inactive > 1 Month

Governance Process

Lifecycle Management & Actions

What happens once the report is delivered? Defining the roles and automated responses.

1. T+14 Days: Automated Notification Fully Automated

The Logic App sends a courtesy email to the user and their manager: "We noticed you haven't logged in for 2 weeks. If you are on extended leave, no action is required. If not, please contact IT."

2. T+21 Days: Helpdesk Validation Manual Review

The IT Service Desk cross-references the report with HR leave records. If the user is not on authorized leave, they are moved to a "Suspicious Inactivity" watchlist.

3. T+30 Days: Soft Account Lock Fully Automated

Action: User account is set to AccountEnabled = False.
Who: Triggered by Logic App based on the "Red" highlight criteria.
Result: Prevents unauthorized access while preserving mailbox and data for recovery.

4. T+30 Days: Endpoint Isolation Fully Automated

Action: If an endpoint is also inactive, it is moved to a "Restricted" Intune Group or Microsoft Defender for Endpoint isolation.
Result: Device is blocked from reaching internal resources until re-certified by IT Security.

5. T+90 Days: Permanent Deletion / Archive Manager Approval

Final confirmation with Department Heads. Accounts are archived and license seats are released to optimize costs.