get-user-account-status-history
get-user-account-status-historyCheck when a user account was disabled or re-enabled in Microsoft 365 by reading the Entra audit log, showing who made the change and the result.
Instructions
When was a user DISABLED (or re-enabled), by whom, with what result? Reads the Entra directory audit log (category UserManagement) for the given user and returns only the events that changed accountEnabled: 'Disable account' / 'Enable account' activities and 'Update user' events whose modifiedProperties contain AccountEnabled (true -> false = disabled). Other user updates are excluded. Newest first. RETENTION: Entra keeps directory audits 30 days (P1/P2; 7 days Free) - if the change is older the result is explicitly 'not available in audit log'; no date is estimated. Read-only; needs delegated AuditLog.Read.All + Directory.Read.All with admin consent and a reader role (Reports Reader / Security Reader / Global Reader).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End of explicit time range (ISO date or datetime) | |
| from | No | Start of explicit time range (ISO date or datetime, overrides timeRange) | |
| change | No | Which state changes to return: disabled (true->false), enabled (false->true) or any (default) | |
| cursor | No | Continuation token (nextCursor of a previous truncated response). Continues that listing; other query inputs are ignored. | |
| maxItems | No | Maximum items to return across pages (default 50, max 500). Pagination via @odata.nextLink is handled automatically; when the result is truncated, pass its nextCursor as cursor to continue. | |
| timeRange | No | Named time range applied on activityDateTime | |
| userIdOrUpn | Yes | Entra object id or userPrincipalName of the target user, e.g. kiss.peter@ceg.hu |