Slack Guests Outlast Projects—Find Access That No Longer Has an Owner
Connect guest accounts to channel membership, activity, and an accountable sponsor before access quietly persists.
Contractors finish projects, partner contacts change, and guest accounts remain in channels because nobody owns the cleanup decision. A last-active date alone cannot reveal whether access is still needed.
PSForge helps combine Slack audit, membership, app, and user-management tasks into a reviewable PowerShell workflow. It does not continuously monitor Slack or deactivate accounts without an operator running the generated script.
Prerequisites and safe scope
Define the workspaces, guest types, inactivity threshold, sponsor requirement, and protected channels in scope. Use an approved Slack token with only required API scopes and follow retention, legal hold, and HR policies.
Exclude legal matters, incident channels, executives, bots, integrations, and users without resolved ownership. Deactivation and channel removal are separate decisions.
Build an ownership-focused review
- Generate the user audit and guest-user inventory.
- Generate the workspace-wide user activity export, which uses each profile's updated timestamp as an activity proxy; manually correlate candidate rows and do not treat it as message or login history.
- Retrieve membership for each manually selected channel; the channel task does not discover every channel reachable by a user.
- Review the installed app/bot inventory for possible automation dependencies; it does not map a guest to an app or provide a full OAuth-scope audit.
- Manually ask sponsors to retain, narrow, or remove access.
- Deactivate only approved users and rerun the audit.
Verification and evidence
Confirm the expected user state and membership outcome, then check app or workflow owners for disruption. Preserve exceptions with an owner and next review date rather than silently treating them as clean.
Keep scope, timestamps, exports, sponsor responses, API results, and exception records. Profile-update age is only a review signal, and an audit export does not prove that every confidential conversation or downstream integration is protected.
Example Slack guest review
- Generate user and guest audit data
- Generate the workspace activity proxy and manually correlate candidates
- Select relevant channels manually and collect membership for each
- Check the installed app/bot inventory and investigate dependencies manually
- Obtain sponsor decisions manually
- Deactivate approved users and verify results
Final thoughts
Guest access should have a current sponsor, a current purpose, and a documented review outcome.
PSForge makes the inventory and controlled changes repeatable without converting ambiguous inactivity into automatic removal.