Microsoft 365: Inactive Users with Assigned LicensesCategory: User Activity & LicensingDescription:Identifies Microsoft 365 users with assigned licenses who have not signed in (either interactively or non-interactively) for more than 30 days. It provides details about the user’s display name, assigned licenses, and the number of days since their last sign-in activity.Purpose:To ensure license optimization by identifying inactive users who are still consuming valuable licenses, enabling proactive management and cost reduction.How It Works:Filtering: Extracts user accounts where licenses are assigned, the account is enabled, and last sign-in activity (both interactive and non-interactive) exceeds 30 days.Output: Presents data as a table with columns for:User Display NameAssigned License (or "Not Assigned" if no licenses are allocated)Days since last non-interactive sign-inDays since last interactive sign-inSeparator row (--) for better readabilityBeneficiaries:IT Administrators: Gain visibility into inactive users with assigned licenses to optimize resource allocation.Finance Teams: Identify opportunities for cost-saving by reclaiming unused licenses.Operations Teams: Streamline licensing audits and compliance reporting.Notes:Making Changes:To adjust the inactivity threshold, change the 30 in the time_since conditions to a desired value (e.g., 60 for a 2-month threshold).Why Changes Are Valuable:Custom Thresholds: Different organizations may have varying definitions of inactivity based on their operational requirements.Granularity: Adding filters for user groups or roles allows targeted insights for specific teams or departments.

Users[?Assigned_Products != null && Assigned_Products != '' && accountEnabled == && (time_since(signInActivity.lastNonInteractiveSignInDateTime, 'days') > || time_since(signInActivity.lastSignInDateTime, 'days') > )] .[ ['User:' Display_Name], ['Assigned License:' Assigned_Products || 'Not Assigned'], ['Days Since Last Non-Interactive Sign In:' time_since(signInActivity.lastNonInteractiveSignInDateTime, 'days')],['Days Since Last Interactive Sign In:' time_since(signInActivity.lastSignInDateTime, 'days')], ['--'] ][]