Does adm-InactivityDuration account for cloud only logins?

Question

We have some users who work offsite and rarely authenticate to our local domain controllers but they frequently log into our M365/Entra environment. Will the adm-InactivityDuration freshen when they login into Entra even if they haven't logged into local AD in a long time? I'm worried about these users getting automatically deprovisioned by rules making use of adm-InactivityDuration.

Edit: I just tested using reports and one of these users and this does not appear to be the case, even though our Entra tenant is linked also and the user isn't considered "inactive" there. Is there a way to check if they are inactive in both local AD and Entra before proceeding?

Answer 1

Hello,

Will the adm-InactivityDuration freshen when they login into Entra even if they haven't logged into local AD in a long time?

No, it will not. The property value will only update when the actual on-premises user account logs on to the system.

Is there a way to check if they are inactive in both local AD and Entra before proceeding?

Yes, it is possible. You can use the If is inactive <period> to check activity of the on-premises account itself and the following script from our repository to check the Microsoft Entra part: https://www.adaxes.com/script-repository/check-if-account-is-inactive-in-azure-ad-longer-than-a-period-of-time-s662.htm.