Home

Azure LastLogon

%3CLINGO-SUB%20id%3D%22lingo-sub-890628%22%20slang%3D%22en-US%22%3EAzure%20LastLogon%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-890628%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3EI%20would%20need%20to%20get%20list%20of%20users%20who%20have%20%22Last%20LogOn%22%203%2C%206%2C%209%2C%2012%20and%20over%20months%20ago.%3C%2FP%3E%3CP%3EIs%20this%20something%20I%20would%20do%20over%20Powershell%20or%20is%20it%20possible%20to%20get%20it%20directly%20from%20Azure%20portal%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKind%20regards%2C%3C%2FP%3E%3CP%3EDino%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-890628%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Resource%20Management%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMonitoring%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%20%26amp%3B%20Compliance%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-891234%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20LastLogon%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-891234%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F390770%22%20target%3D%22_blank%22%3E%40DiVojich%3C%2FA%3E-%20I'm%20assuming%20you%20are%20asking%20about%20access%20to%20the%20Portal%20(or%20access%20to%20the%20Subscription)%3F%20I%20don't%20know%20if%20there%20is%20a%20specific%20event%20that%20is%20generated%20for%20just%20logging%20in.%20Are%20you%20using%20AzureAD%20for%20access%20to%20your%20subscription%3F%20If%20so%2C%20you%20might%20be%20able%20to%20ascertain%20that%20through%20some%20of%20the%20AzureAD%20reporting%2C%20but%20I'd%20have%20to%20dig%20into%20if%20this%20was%20even%20possible.%20Otherwise%2C%20you%20can%20see%20some%20of%20the%20items%20that%20are%20available%20in%20the%20GUI%20with%20standard%20Activity%20Logging%20in%20the%20article%20below....%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Factivity-logs-overview%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Factivity-logs-overview%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20helps%20you%20some.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-891357%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20LastLogon%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-891357%22%20slang%3D%22en-US%22%3EUnfortunately%2C%20none%20of%20this%20exactly%20helps%20me.%3CBR%20%2F%3EI%20will%20have%20to%20come%20up%20with%20PS%20idea....%3CBR%20%2F%3EThanks%20for%20advice%20%3A)%3C%2Fimg%3E%3C%2FLINGO-BODY%3E
DiVojich
Contributor

Hi,

I would need to get list of users who have "Last LogOn" 3, 6, 9, 12 and over months ago.

Is this something I would do over Powershell or is it possible to get it directly from Azure portal?

 

Kind regards,

Dino

2 Replies

@DiVojich- I'm assuming you are asking about access to the Portal (or access to the Subscription)? I don't know if there is a specific event that is generated for just logging in. Are you using AzureAD for access to your subscription? If so, you might be able to ascertain that through some of the AzureAD reporting, but I'd have to dig into if this was even possible. Otherwise, you can see some of the items that are available in the GUI with standard Activity Logging in the article below....

 

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-logs-overview 

 

Hope this helps you some.

Unfortunately, none of this exactly helps me.
I will have to come up with PS idea....
Thanks for advice :)
Related Conversations
Extentions Synchronization
ChirmyRam in Discussions on
3 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
35 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
9 Replies