Find disabled Entra users
Documentation: Microsoft Learn
The -Filter argument hands accountEnabled eq false to Graph as an OData expression so the service performs the selection.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-MgUser -All -Filter "accountEnabled eq false" -Property DisplayName,UserPrincipalName | Select-Object DisplayName,UserPrincipalName- Stage 1Get-MgUser
-All -Filter -Property - Stage 2Select-Object
Positional values or no named parameters
How it works
The -Filter argument hands accountEnabled eq false to Graph as an OData expression so the service performs the selection. Only the display name and UPN are requested and projected, which keeps each response small.
Adapting it
Append a createdDateTime clause to the filter string to focus on accounts old enough that removing them is uncontroversial, rather than reviewing every disabled account in the tenant.
Requirements
Microsoft.Graph module and a Graph session with User.Read.All.
If the result is unexpected
A disabled-user report disagrees with the Entra portal.
AccountEnabled may not have been selected, or the session may point to a different tenant.
- Retrieve AccountEnabled explicitly for a known account and verify the tenant before applying the filter.
Validate the result
The report uses actual Boolean values rather than treating an unrequested property as disabled.
Keep the check reliable
Select every property used by a filter and retain the tenant identifier in output.
