Paul Contreras

Hi, my name is Paul and I am a Sysadmin who enjoys working on various technologies from Microsoft, VMWare, Cisco and many others. Join me as I document my trials and tribulations of the daily grind of System Administration.


  1. Is there a way to find the last time a user signed on, regardless of when it was? This was easy in an on-prem environment, but seems unavailable for Azure/Entra. I would like a way to determine unused accounts.

  2. The Get-AzureAdAuditSigninLogs value is quite useless when attempting to determine user accounts that have not been used recently as this only goes back 30 days. I would expect CreatedDateTime to return the date/time the account was created. I can’t tell what data is returned. Users are listed multiple times and the date is always today. This is useless. I don’t understand why Microsoft makes things so difficult these days. For on-prem, this is easily obtained by a single command (Get-ADUser) and the information is complete and accurate.

  3. I seem to have dates going back three years… users with $null can be new users who have not logged on yet, and shared mailboxes (as it’s the accessing users account that logs on to those).

    Was longer retention of this introduced at some stage?

  4. I wrote a similar thing but we are at the mercy of the MS servers for responding to queries. A query for 100 users has so far taken over 2 hours to run. An on-prem query for 100 users finishes in about 3 seconds.

  5. Thank you for include John Snow, Tony Stark, and Buzz Lightyear. This working for me.

  6. Sadly this will not work if you don’t have a P1 / 2 Azure AD license:

    Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
    Code: Authentication_RequestFromNonPremiumTenantOrB2CTenant
    Message: Neither tenant is B2C or tenant doesn’t have premium license

  7. Hi, great article!
    I am a bit of newbie in this but I am trying to build a script that gives me the login status for a series of users.

    I have tried this, but with no visible results:

    #Import the Azure AD Module
    Import-Module AzureADPreview

    #Connect to Azure AD
    Connect-AzureAD -AccountId [email protected]

    $CSVData = @(Import-CSV -Path AzureADBulkUserCreation.csv -ErrorAction Stop)
    Write-Verbose “Successfully imported entries from $FilePath”
    Write-Verbose “Total no. of entries in CSV are : $($CSVData.count)”

    Foreach ($Entry in $CSVData) {
    # Verify that mandatory properties are defined for each object
    $UserPrincipalName = $Entry.UserPrincipalName

    foreach ($UserPrincipalName in $CSVData) {
    Get-AzureADAuditSignInLogs -Filter “UserPrincipalName eq ‘$UserPrincipalName'” -Top 1 | `
    select CreatedDateTime, UserPrincipalName, IsInteractive, AppDisplayName, IpAddress, TokenIssuerType, @{Name = ‘DeviceOS’; Expression = {$_.DeviceDetail.OperatingSystem}}

    Any idea of what could be going wrong?

    • Please check if the users in the CSV file have any Sign in logs available in the last 30 days.
      I had the similar issue and realized that there were no Sign in logs for the users I tried in the last 30 days.

Leave a Reply

Your email address will not be published.