Test-MtEntraAgentInactive
SYNOPSIS
Finds enabled Agent Identities that have not signed in or been active within 180 days.
SYNTAX
Test-MtEntraAgentInactive [[-MaxInactiveDays] <Int32>] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
DESCRIPTION
Checks whether enabled Agent Identities have recent sign-in activity, and separately flags a Blueprint whose entire fleet of child Agent Identities is inactive while the Blueprint still holds a live (non-expired) credential. Stale enabled agents retain permissions and token-exchange capabilities without operational oversight, increasing the risk of unmonitored persistence or unused privileges; a fully dormant fleet with a live parent credential is a stronger signal that the Blueprint itself is a cleanup candidate.
EXAMPLES
EXAMPLE 1
Test-MtEntraAgentInactive
PARAMETERS
-MaxInactiveDays
Maximum allowed days of inactivity before flagging an enabled agent. Defaults to 180 days.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 1
Default value: 180
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.