This article is contributed. See the original author and article here.

Deprecated accounts are the accounts that were once deployed to a subscription for some trial/pilot initiative or some other purpose and are not required anymore. The user accounts that have been blocked from signing in should be removed from subscriptions. These accounts can be targets for attackers finding ways to access your data without being noticed.
The Azure Security Center recommends identifying those accounts and removing any role assignments on them from the subscription, however, it could be tedious in the case of multiple subscriptions.



  Az Modules must be installed

 – Service principal created as part of Step 1 must be having owner access to all subscriptions


Steps to follow:

Step 1: Create a service principal

Post creation of service principal, please retrieve below values.

  1. Tenant Id

  2. Client Secret

  3. Client Id

Step 2: Create a PowerShell function which will be used in generating authorization token

function Get-apiHeader{
$tokenresult=Invoke-RestMethod -Uri$TENANTID/oauth2/token?api-version=1.0 -Method Post -Body @{"grant_type" = "client_credentials"; "resource" = "https://$resource/"; "client_id" = "$ClientId"; "client_secret" = "$PasswordClient" }
  'Authorization'="Bearer $token"
return $Header


Step 3: Invoke API to retrieve authorization token using function created in above step

Note: Replace $TenantId, $ClientId and $ClientSecret with value captured in step 1


$AzureApiheaders = Get-apiHeader -TENANTID $TenantId -ClientId $ClientId -PasswordClient $ClientSecret -resource ""



Step 4: Extracting csv file containing list of all deprecated accounts from Azure Resource Graph

Please refer

Azure Resource graph explorer:



        | where type == ""
        | extend source = tostring(properties.resourceDetails.Source)
        | extend resourceId =
            trim(" ", tolower(tostring(case(source =~ "azure", properties.resourceDetails.Id,
        | extend status = trim(" ", tostring(properties.status.code))
        | extend cause = trim(" ", tostring(properties.status.cause))
        | extend assessmentKey = tostring(name)
        | where assessmentKey == "00c6d40b-e990-6acf-d4f3-471e747a27c4"





Click on “Download as CSV” and store at location where removal of deprecated account script is present. Rename the file as “deprecatedaccountextract


Set-Location $PSScriptRoot
$RootFolder = Split-Path $MyInvocation.MyCommand.Path
$ParameterCSVPath =$RootFolder + "deprecatedaccountextract.csv"
if(Test-Path -Path $ParameterCSVPath)                                                                          
$TableData = Import-Csv $ParameterCSVPath

foreach($Data in $TableData)
  #Get resourceID for specific resource 
  #Get control results column for specific resource
  $newresult=$controlresult | ConvertFrom-Json
  $splitres=$ObjectIdList -split(',')
  $deprecatedObjectIds=$splitres -replace $regex
  foreach($objectId in $deprecatedObjectIds)
    #API to get role assignment details from Azure
    $resourcedetails=(Invoke-RestMethod  -Uri $resourceURL -Headers $AzureApiheaders -Method GET)
    if( $null -ne $resourcedetails )
     foreach($value in $resourcedetails.value)
      if($ -eq $objectId)
       Invoke-RestMethod  -Uri $remidiateURL -Headers $AzureApiheaders -Method DELETE
     Write-Output "There are no Role Assignments in the subscription"






Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

%d bloggers like this: