signInActivity without Entra ID P1 — the retry without it turns "not measured" into "0 inactive users"

Situation

You build an inactive-users, stale-guests or unused-licences report on Graph:

GET https://graph.microsoft.com/v1.0/users?$select=id,userPrincipalName,accountEnabled,assignedLicenses,signInActivity&$top=999

It works in your dev tenant (which has Business Premium, E3/E5 or an Entra ID P1 trial). In a tenant with only Business Basic/Standard it returns 403. Microsoft documents the requirement and the error text in Neither tenant is B2C or tenant doesn't have premium license and in How to detect inactive user accounts.

The trap

let users;
try {
  users = await getAll('/users?$select=id,upn,assignedLicenses,signInActivity');
} catch {
  users = await getAll('/users?$select=id,upn,assignedLicenses'); // "graceful" fallback
}
const inactive = users.filter(u => u.signInActivity?.lastSuccessfulSignInDateTime
  && daysSince(u.signInActivity.lastSuccessfulSignInDateTime) > 90);
// → [] in every tenant without P1. The dashboard proudly says "0 inactive".

The fallback is right — you still want the list of users and licences — but the information that the measurement did not happen is thrown away. Downstream, a rule engine closes the finding ("resolved"), a KPI tile shows 0 and a cost estimate shows 0 Kč.

Fix

Keep the fallback, but return the measurement state alongside the data and make every consumer honour it:

type SignInMeasure = { measured: true } | { measured: false; reason: 'premium' | 'forbidden' | 'error' };

async function loadUsers(): Promise<{ users: User[]; signIn: SignInMeasure }> {
  try {
    return { users: await getAll(Q_WITH_SIGNIN), signIn: { measured: true } };
  } catch (e) {
    const status = (e as { status?: number }).status;
    const users = await getAll(Q_WITHOUT_SIGNIN);
    return { users, signIn: { measured: false, reason: status === 403 ? 'premium' : 'error' } };
  }
}

• Rules / findings: when measured === false, produce no "inactive" finding and do not auto-close an existing one — treat the source as unread.
• UI: show ? or "not measured — requires Entra ID P1" instead of 0; if part of a total was measured (e.g. disabled accounts), show it as a lower bound (≥ 3).
• Persist it: if you store snapshots, store the flag too, otherwise a later trend chart turns the gap into a real-looking dip.
• accountEnabled, assignedLicenses and /subscribedSkus do not need P1 — disabled-but-licensed accounts and unassigned seats can still be reported.

See also

• perUserMfaState says "disabled" under Conditional Access — another report that needs P1 and fails quietly.