Monthly

Get a monthly list of inactive Teams guests

Each month you see the guest accounts that haven't signed in for 90 days, so you can remove them.

Runs: Monthly
Apps: Microsoft Teams
AI: Not needed
Access: read (User.Read.All, AuditLog.Read.All, admin consent)

Send this to your assistant

Create a ClickRuntime automation: on the 1st of each month at 9am, email me the guest users in our tenant who haven't signed in for 90 days, with their name, email and last sign-in date.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

Guests accumulate in Microsoft Teams without anyone deciding to keep them. A contractor finishes a project, a partner changes jobs, a client ends the contract, but their guest accounts remain with access to channels and files. Each inactive guest is an open door to your data that nobody is watching. Auditors ask for exactly this list, and when nobody has produced it, the review becomes a scramble before the audit.

Once a month, ClickRuntime lists the guest users in your Microsoft tenant along with their last sign-in activity, keeps those who have not signed in for 90 days, and emails you the list with names and addresses. Nothing is removed automatically, so you decide who to remove.

IT administrators, security officers and compliance teams use it to keep access aligned with who actually still works with the company.

What you get out of it

Fewer unnecessary doors to your data
Every guest who no longer needs access is a risk if their credentials are compromised. Reviewing inactive ones monthly shrinks the number of accounts an attacker could use. That lowers the odds of a breach through forgotten credentials.
Audit evidence on demand
Compliance frameworks expect periodic access reviews. A dated monthly list of stale guests, and what you did about it, is straightforward proof for auditors. That saves days of preparation before each review.
Offboarding gaps are discovered
If a project ended without anyone removing the external team, the list shows it. You can close that loop with the project owner, instead of finding out during an incident.
Licenses and clutter are trimmed
Guest lists full of inactive people make it harder to find real participants. A cleaner directory also makes channel membership easier to review. A tidy list is easier for owners to maintain too.
You stay in control of removals
Because the report only lists accounts, a guest who is merely on a long leave is not deleted by accident. You can ask the owner first, then act. That keeps trust with partners high.
A routine instead of an annual panic
A monthly check spreads the work out in small pieces. The list is short each time, so it actually gets reviewed, rather than becoming an unmanageable spreadsheet. Short lists get read and acted on.

How it works

What happens, step by step

Once a month ClickRuntime lists the guest accounts in your Microsoft 365 organisation, the outside people invited to your Teams.
It checks when each one last signed in.
You get an email listing guests who haven't signed in for 90 days or more, so you can remove their access.

Before it runs live

Connect Microsoft Teams

What you get

RunsMonthly

Get a monthly list of inactive Teams gueststoday, 9:00Succeeded

Email · 3 guest accounts inactive for 90 daysCasey Lin <casey@acme.example>: last sign-in 2026-05-02 Pat Moreno <pat@northwind.example>: last sign-in never

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Microsoft Teams steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

stale_guest_account_report.pyexample

from datetime import datetime, timedelta, timezone
from clickruntime import on_trigger, credentials, http, notify

GRAPH = "https://graph.microsoft.com/v1.0"

@on_trigger
def run(event):
    headers = {"Authorization": f"Bearer {credentials.connection('microsoft', 'work')}"}
    cutoff = (datetime.now(timezone.utc) - timedelta(days=90)).isoformat()
    url = f"{GRAPH}/users?$filter=userType eq 'Guest'&$select=displayName,mail,signInActivity&$top=200"
    stale = []
    while url:
        page = http.get(url, headers=headers).json()
        for u in page["value"]:
            last = (u.get("signInActivity") or {}).get("lastSignInDateTime")
            if not last or last < cutoff:
                stale.append(f"{u['displayName']} <{u.get('mail')}>: last sign-in {last[:10] if last else 'never'}")
        url = page.get("@odata.nextLink")
    notify.email_me(f"{len(stale)} guest accounts inactive for 90 days", "\n".join(stale) or "None.")
    return {"stale": len(stale)}

FAQ

Common questions

How is last sign-in determined?

It uses the sign-in activity that Microsoft Entra ID records for each guest account. If a guest has never signed in, they can be included in the list as well, because an account that was never used is also a candidate for removal.

Does it need special permissions in Microsoft 365?

Reading sign-in activity requires specific directory permissions, and the information may depend on your Microsoft license. An administrator needs to grant these when connecting, and the credentials are stored as secrets in ClickRuntime. Ask your Microsoft 365 admin if consent is needed.

Can I change the 90-day limit?

Yes. Some organizations use 60 days, others 180. Tell your AI assistant the number of days that matches your policy, review the change it shows, and approve it so the next report uses the new limit.

What permissions does it need?

read (User.Read.All, AuditLog.Read.All, admin consent). Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (monthly). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Daily or weekly