ChangeStaleUser.ps1

# First create all needed variables for your situation
$OrganizationName = "organizationname"
$AdminUser = "Admin@Exampleorganisation.com"
$Token = "ThePATKey"
$DaysTillScaleDown = 31

# The Header is created with the given information.
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $AdminUser, $Token)))
$Header = @{
    Authorization = ("Basic {0}" -f $base64AuthInfo)
}

# Create the hashtable for the splat and collect users
$UserParameters = @{
    Method  = "GET"
    Headers = $Header
    Uri     = "https://vsaex.dev.azure.com/$OrganizationName/_apis/userentitlements?api-version=5.1-preview.2"
}
$Users = (Invoke-RestMethod @UserParameters).members

$ScaleDownDate = (Get-Date).AddDays( - ($DaysTillScaleDown))
# The body to change the license to Stakeholder is always the same, so we can create it here
$body = @{
    from  = ""
    op    = "replace"
    path  = "/accessLevel"
    value = @{
        accountLicenseType = "Stakeholder"
        licensingSource    = "account"
    }
}
#Go through all Users
foreach ($User in $Users) {
    $AccessDate = $User.lastAccessedDate
    $License = $User.accessLevel.accountLicenseType
    # Select all users that have nog logged in for the set ammount of time and that have a payed license (basic or basic+test)
    if (
        $AccessDate -lt $ScaleDownDate -and
        ($License -eq "Express" -or
            $License -eq "Advanced")
    ) {
        # Create a new parameter hashtable to splash
        $ChangeLicenseParameters = @{
            Method      = "Patch"
            Headers     = $Header
            Uri         = "https://vsaex.dev.azure.com/$OrganizationName/_apis/userentitlements/$($User.id)?api-version=5.1-preview.2"
            body        = "[$($body | ConvertTo-Json)]" 
            ContentType = "application/json-patch+json"
        }
        Invoke-RestMethod @ChangeLicenseParameters
    }
}