Comments on: Get Azure AD Last Login Date And Sign-In Activity

By: Mongoose

Mongoose — Wed, 13 Dec 2023 20:34:10 +0000

Is there a way to find the last time a user signed on, regardless of when it was? This was easy in an on-prem environment, but seems unavailable for Azure/Entra. I would like a way to determine unused accounts.

By: Mongoose

Mongoose — Mon, 11 Dec 2023 20:28:35 +0000

The Get-AzureAdAuditSigninLogs value is quite useless when attempting to determine user accounts that have not been used recently as this only goes back 30 days. I would expect CreatedDateTime to return the date/time the account was created. I can’t tell what data is returned. Users are listed multiple times and the date is always today. This is useless. I don’t understand why Microsoft makes things so difficult these days. For on-prem, this is easily obtained by a single command (Get-ADUser) and the information is complete and accurate.

By: Simon

Simon — Tue, 22 Aug 2023 11:52:23 +0000

I seem to have dates going back three years… users with $null can be new users who have not logged on yet, and shared mailboxes (as it’s the accessing users account that logs on to those).

Was longer retention of this introduced at some stage?

By: Nadim J

Nadim J — Tue, 02 May 2023 17:27:32 +0000

I wrote a similar thing but we are at the mercy of the MS servers for responding to queries. A query for 100 users has so far taken over 2 hours to run. An on-prem query for 100 users finishes in about 3 seconds.

By: Mike

Mike — Tue, 07 Mar 2023 16:13:39 +0000

Thank you for include John Snow, Tony Stark, and Buzz Lightyear. This working for me.

By: James McDonald

James McDonald — Mon, 28 Nov 2022 07:01:15 +0000

Sadly this will not work if you don’t have a P1 / 2 Azure AD license:

Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
Code: Authentication_RequestFromNonPremiumTenantOrB2CTenant
Message: Neither tenant is B2C or tenant doesn’t have premium license

By: Sonic

Sonic — Mon, 10 Oct 2022 17:58:47 +0000

is there a way to get the same but for “non-interactive logon”?

By: Egor

Egor — Fri, 22 Jul 2022 18:49:49 +0000

In reply to Cory.

That is correct. If there’s been no activity in the last 30 days, this will return $null. A better way would be calling https://graph.microsoft.com/beta/users/user@example.org?$select=displayName,signInActivity

By: Hanisha

Hanisha — Wed, 20 Jul 2022 10:12:49 +0000

In reply to Flávio Neto. Please check if the users in the CSV file have any Sign in logs available in the last 30 days. I had the similar issue and realized that there were no Sign in logs for the users I tried in the last 30 days.

By: Cory

Cory — Fri, 08 Jul 2022 14:09:42 +0000

I believe this only goes back 30 days?