Access & identity · Identity Lifecycle

Set an Entra ID account to expire, and reap stale guests, without P2 licensing

Q: Where do I get support?

support@llmgraph.ai, or the support page on katabarwalabs.dev.

The cloud equivalent of accountExpires, plus a warn, disable, delete pipeline for inactive guests. Two governance features Microsoft gates behind P2, as one flat fee.

Deploy from the Azure Marketplace Read the background

Deploys as a managed application in your own subscription. No vendor backend, no data egress. Flat monthly fee, billed by Microsoft.

The gap

On-premises AD had accountExpires. Entra ID has employeeLeaveDateTime, which does nothing unless you pay for Governance. Contractors, temps, and interns keep working accounts long after they leave, and guests invited for one project stay forever.

What it does

Account expiry: set employeeLeaveDateTime on any user and the app warns at 14, 7, and 1 days, then disables the account the day after.
Stale guest reaper: guests inactive for N days are reported, disabled after a grace period, and optionally deleted after a further period.
Stages are tracked in the app's own table storage, so nothing is warned twice or skipped.
Ships in dry run: reports only, no changes, until you flip DRY_RUN=false after reviewing the output.
Every action posted to Teams.

The expiry report: who is leaving when, and what the app will do about it.

Stale guests by last sign-in, with their current stage.

Dry-run output before anything is changed.

Honest about its limits

Disabling and deleting accounts is a real write path, which is why dry run is the default and the permissions are listed plainly below.
Inactivity is judged from sign-in activity, which Entra reports with some delay; the grace period exists for that reason.
The one write path, honestly scoped: Disabling accounts past their leave date and disabling or deleting stale guests, only after dry run is turned off and the grace periods you set have elapsed.

How it runs, and what it needs

A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so nothing runs until you say so. Every role it asks for, and why:

Microsoft Graph User.Read.All and AuditLog.Read.All	read users and sign-in activity
Microsoft Graph LifeCycleInfo.Read.All	read employeeLeaveDateTime
Microsoft Graph User.EnableDisableAccount.All and User.ReadWrite.All	disable expired accounts and stale guests, and delete guests if you enable it

Alerts go to the Teams webhook you configure. Nothing is sent anywhere else.

FAQ

Does any data leave my subscription?

No. The function runs in your subscription and writes only to your configured alert destination. Katabarwa Labs operates no backend and receives nothing.

How is it billed?

A flat monthly fee on your Azure bill through the Marketplace, plus the small consumption cost of the function itself. No per-resource or per-user pricing.

How do I remove it?

Delete the managed application from the Azure portal. Its resource group and identity go with it, and any role you granted can be removed the same way.

Where do I get support?

support@llmgraph.ai, or the support page.

Deploy Identity Lifecycle in your subscription.

The cloud equivalent of accountExpires, plus a warn, disable, delete pipeline for inactive guests. Two governance features Microsoft gates behind P2, as one flat fee.

Deploy from the Azure Marketplace