Expired Guest Access Cleanup

Overview

A scheduled (weekly) Power Automate cloud flow that audits the tenant for guest user accounts whose createdDateTime is older than a configurable threshold and removes them via Microsoft Graph. Each removal is logged to a SharePoint audit list, and a summary email is sent to IT after every run with activity. The flow ships Off — turning it on requires only configuring the Graph app registration secrets and authorizing the SharePoint + Outlook connection references.

Use Case

Microsoft Entra ID tenants that allow B2B collaboration accumulate guest user accounts indefinitely unless governance is enforced. Stale guests inflate the user directory, complicate license reporting, and represent an avoidable security surface (compromised partner accounts, departed contractors, abandoned vendor invitations). This flow gives IT Admins a low-touch, auditable cleanup loop.

The flow is ideal for teams that:

• Define an expiration window (default 365 days from createdDateTime).
• Run weekly on Monday at 8:00 AM Eastern.
• Delete via Graph and log every action to SharePoint with the run ID, age in days, and Graph response code for traceability.
• Notify IT only when there is activity (removals or failures).

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Register an Entra ID app

Register an Entra ID app with Microsoft Graph application permissions User.ReadWrite.All and grant admin consent. Copy the tenant ID, app (client) ID, and a fresh client secret.

Update the three Graph env vars

In the solution, set flowlibs_GraphTenantId, flowlibs_GraphClientId, and flowlibs_GraphClientSecret using Current Value (leave Default Value alone so other flows keep working).

Tune the expiration policy

Edit flowlibs_GuestExpirationDays (raise to 730 for a softer policy, lower to 90 for hot tenants).

Authorize the connection references

Open the solution and set SharePoint and Office 365 Outlook to active connections owned by the user or service account that runs the flow.

Confirm the SharePoint audit list exists

Verify the tenant root has a list named FlowLibs - Expired Guest Cleanup Log with columns: GuestObjectId, GuestDisplayName, GuestEmail, GuestUserPrincipalName, GuestCreatedDateTime, AgeInDays, DeletionStatus, GraphResponseCode, FlowRunId. Provisioned by this build.

Open the flow in the designer once

Open the flow once so the SharePoint PostItem dynamic-schema warning resolves (Power Automate caches the column list on first save), then re-Save.

Turn the flow On

First scheduled run is the next Monday at 08:00 Eastern; trigger a manual test run after-hours first.

Optional: switch from full delete to soft block

Replace the HTTP_Delete_Guest_User body with a PATCH to /users/{id}

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{getPastTime(int(parameters('flowlibs_GuestExpirationDays')), 'Day', 'yyyy-MM-ddTHH:mm:ssZ')}

@{concat('userType eq ''Guest'' and createdDateTime lt ', variables('varCutoffDate'))}

@{concat('https://graph.microsoft.com/v1.0/users/', items('Foreach_Expired_Guest_User')?['id'])}

@div(sub(ticks(utcNow()), ticks(items('Foreach_Expired_Guest_User')?['createdDateTime'])), 864000000000)

@{coalesce(items('Foreach_Expired_Guest_User')?['displayName'], items('Foreach_Expired_Guest_User')?['userPrincipalName'], items('Foreach_Expired_Guest_User')?['id'])}

@{workflow()?['run']?['name']}

runAfter Scope_Delete_Guest: ['Failed','TimedOut','Skipped']