How To Run Scheduled Graph API Checks for Expired Licenses and Inactive Users Microsoft 365 license sprawl and inactive Microsoft Entra ID accounts quietly increase costs and security risk. Let’s walk through how to automate scheduled Microsoft Graph API checks to identify expired licenses and dormant users using PowerShell. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Why Automating License And User Audits Matters First, unused Microsoft 365 licenses drain budgets month after month. At the same time, inactive user accounts increase your attack surface and complicate compliance audits. Manual reviews rarely scale, especially for MSPs or multi-tenant environments. Automated Graph API checks solve both problems by delivering consistent visibility across tenants on a predictable schedule. How To Prepare Your Graph API Environment Next, you need the right permissions and tools. Start with PowerShell 7 and the Microsoft Graph PowerShell SDK. Your account, or registered Microsoft Entra ID app, must have User.Read.All, Reports.Read.All, and Directory.Read.All permissions. For unattended execution, consider certificate-based authentication or Azure Key Vault-backed secret management instead of storing secrets locally. This setup ensures your scripts can run reliably without user interaction. How To Identify Unused Licenses And Inactive Users ,After that, query tenant-level license usage using subscribed SKU data to calculate available licenses. Then, pull unlicensed users to catch provisioning gaps. Finally, identify licensed users who have not signed in within a defined threshold, such as 90 days. Keep in mind that SignInActivity reporting requires Microsoft Entra ID Premium P1 or P2 licensing. This step highlights accounts that create both security and cost risk. Exporting results to CSV creates clear, auditable records that can be shared with stakeholders. How To Schedule And Scale The Checks, Meanwhile scheduling turns one-time scripts into continuous monitoring. On a single machine, Task Scheduler can run audits weekly or monthly under the system account even when no user is logged in. For MSPs or larger environments, RMM tools like NinjaOne make this far easier. You can deploy scripts across tenants, centralize CSV outputs, and trigger alerts when reports fail to update. Important Limits And Best Practices Finally, avoid beta Graph endpoints in production and exclude service accounts, shared mailboxes, and break-glass accounts from inactivity scans. Set inactivity thresholds based on risk tolerance and align audits with billing cycles. Pair detection with action by automatically reclaiming licenses or disabling dormant accounts using Graph cmdlets after validating organizational policies and approval workflows. For more information, check out our official blog post on scheduled Graph API license and user audits linked in the description below.