I've been auditing our Entra ID tenant and found a bunch of old app registrations still active under departed employees' names. It's a security concern, obviously, but doing it manually is a pain.
I wrote a PowerShell script to find these stale registrations (filtering by owner last login and app last used) and either remove the departed owner or delete the app if it's truly orphaned. Before I run something like this in production, I wanted to see if others have tackled this. Specifically:
* What criteria do you use to define "stale"?
* Is checking owner last sign-in and app credential last used date sufficient?
* How do you handle service principals vs app registrations in your cleanup logic?
I can share the script basics, but I'm more interested in the validation logic and what I might be missing. Our setup is mostly SaaS integrations and some custom internal apps.