Home

How to show inactive user detail

%3CLINGO-SUB%20id%3D%22lingo-sub-73799%22%20slang%3D%22en-US%22%3EHow%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-73799%22%20slang%3D%22en-US%22%3E%3CP%3EI%20need%20to%20be%20able%20to%20report%20on%20users%20who%20have%20not%20been%20active%20for%20more%20than%20180%20days.%20I%20also%20need%20to%20drill%20down%20to%20be%20able%20to%20list%20the%20individual%20users%20and%20their%20last%20activity%20date.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20can%20this%20be%20achieved%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-109224%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-109224%22%20slang%3D%22en-US%22%3E%3CP%3EUnfortunately%2C%20that%20has%20the%20common%20issue%20that%20it%20ONLY%20looks%20at%20mailbox%20logins%20and%20is%20based%20on%20Exchange%20data.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMicrosoft%20seem%20unable%20to%20realise%20that%20not%20everyone%20is%20using%20Exchange%20Online%20and%20that%20logins%20may%20occur%20for%20different%20reasons.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20most%20reliable%20method%20I've%20found%20so%20far%20requires%20you%20to%20run%20a%20complex%20script%20against%20the%20combined%20audit%20log.%20Last%20time%20I%20ran%20it%2C%20it%20took%20over%2010%20hours%20against%207k%20accounts.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20Exchange%20Online%20logins%20are%20a%20reliable%20measure%20of%20user%20activity%20in%20your%20case%20then%20you%20will%20be%20fine%20and%20there%20are%20plenty%20of%20examples%20of%20scripts%20to%20do%20what%20you%20want.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-109198%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-109198%22%20slang%3D%22en-US%22%3E%3CP%3EJulian%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20just%20used%20this%20one.%20I%20was%20hoping%20to%20get%20a%20csv%20export%20but%20this%20at%20least%20listed%20the%20mailboxes%20I%20was%20after%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fcommunity.spiceworks.com%2Fhow_to%2F104316-list-inactive-users-in-office-365%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcommunity.spiceworks.com%2Fhow_to%2F104316-list-inactive-users-in-office-365%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPete%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-109196%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-109196%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Pete%2C%20yes%20and%20not%20a%20single%20response%20from%20anyone%20in%20Microsoft%20-%20which%20is%20my%20experience%20of%20over%203%20years%20of%20trying%20to%20raise%20this%20issue%20with%20them%20both%20directly%20and%20via%20forums%20like%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EClearly%20there%20is%20no%20way%20to%20actually%20produce%20this%20information%20and%20that%20creates%20a%20real%20risk%20to%20using%20O365.%20It%20should%20be%20this%20report%20that%20people%20use%20to%20ensure%20that%20inactive%20accounts%20are%20shut%20down%2C%20not%20leaving%20them%20open%20for%20abuse.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-109183%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-109183%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Julian%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere%20are%20various%20powershell%20scripts%20about.%20I'm%20currently%20browsing%20for%20one%20which%20looks%20trustworthy.%20It%20amazes%20me%20that%20there%20isn't%20a%20standard%20report%20in%20365%20to%20show%20this%20though!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPete%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-568530%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-568530%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F335%22%20target%3D%22_blank%22%3E%40Julian%20Knight%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'd%20suggest%20using%20below%20script%20for%20getting%20Office%20365%20Inactive%20users%20with%20last%20logon%20time%2C%20Inactive%20days%2C%20Mailbox%20type%2C%20Assigned%20license%20and%20Admin%20roles.%3C%2FP%3E%3CP%3E%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fgallery.technet.microsoft.com%2FExport-Office-365-Users-ae3463f2%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EExport%20Office%20365%20Inactive%20Users%26nbsp%3B%3C%2FA%3E%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EScript%20Highlights%3A%3C%2FP%3E%3CUL%3E%3CLI%3E%3CSPAN%3EResult%20can%20be%20filtered%20based%20on%26nbsp%3B%3CSTRONG%3Einactive%20days%3C%2FSTRONG%3E.%3C%2FSPAN%3E%3C%2FLI%3E%3CLI%3E%3CSPAN%3EResult%20can%20be%20filtered%20based%20on%26nbsp%3B%3CSTRONG%3Euser%3C%2FSTRONG%3E%26nbsp%3B%2F%26nbsp%3B%3CSTRONG%3Emailbox%20type%3C%2FSTRONG%3E.%3C%2FSPAN%3E%3C%2FLI%3E%3CLI%3E%3CSPAN%3EResult%20can%20be%20filtered%20to%20lists%26nbsp%3B%3CSTRONG%3Enever%20logged%20in%20mailbox%3C%2FSTRONG%3E%26nbsp%3Balone.%3C%2FSPAN%3E%3C%2FLI%3E%3CLI%3E%3CSPAN%3EExport%20results%20to%26nbsp%3B%3CSTRONG%3ECSV%3C%2FSTRONG%3E%26nbsp%3Bfile.%3C%2FSPAN%3E%3C%2FLI%3E%3CLI%3E%3CSPAN%3EShows%20result%20with%26nbsp%3B%3CSTRONG%3Euser%E2%80%99s%20administrative%20roles%3C%2FSTRONG%3E%26nbsp%3Bin%20O365%20environment.%3C%2FSPAN%3E%3C%2FLI%3E%3CLI%3E%3CSPAN%3EThe%20assigned%20licenses%20column%20will%20show%20you%20the%26nbsp%3B%3CSTRONG%3Euser-friendly-name%3C%2FSTRONG%3E%26nbsp%3Blike%20'Office%20365%20Enterprise%20E3'%20rather%20than%20'ENTERPRISEPACK'.%3C%2FSPAN%3E%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-569378%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-569378%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F295378%22%20target%3D%22_blank%22%3E%40Kathy_Cooper%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Kathy%2C%20thanks%20for%20your%20response%20but%20this%20does%20NOT%20answer%20the%20question%20I'm%20afraid.%20This%20script%2C%20like%20the%20others%20mentioned%26nbsp%3B%3CSPAN%3Eonly%20reports%20when%20users%20last%20logged%20into%20their%20Exchange%20Online%20mailboxes.%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThat%20is%20far%20from%20being%20the%20only%20service%20on%20Office%20365%20and%20if%20the%20user%20is%20not%20using%20their%20mailbox%20but%20is%20using%20other%20aspects%20of%20Office%20365%2C%20this%20will%20result%20in%20an%20incorrect%20report.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20have%20yet%20to%20find%20any%20reliable%20way%20to%20understand%20inactive%20users%20without%20having%20to%20grab%20the%20detailed%20combined%20log%20and%20aggregating%20it%20over%20the%20number%20of%20days%20you%20need%20to%20check%20(unless%20the%20number%20of%20days%20is%20less%20than%20the%20available%20log%20data).%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThis%20remains%20a%20major%20security%20failing%20of%20Office%20365%20since%20there%20is%20no%20simple%20way%20to%20find%20truly%20inactive%20users%20and%20suspend%20them%20as%20best%20practice%20would%20suggest.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-581694%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-581694%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F335%22%20target%3D%22_blank%22%3E%40Julian%20Knight%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3EYes%2C%20Get-mailboxStatistics%20shows%20the%20time%20a%20user%20last%20accessed%20their%20mailbox.%3C%2FDIV%3E%3CDIV%3E%3CBR%20%2F%3EAs%20you%20said%2C%20exact%20login%20time%20can%20be%20retrieved%20from%20Search-UnifiedAuditLog%2C%20which%20requires%20analysis%20of%20extensive%20data.%20I'd%20suggest%20using%20a%20tool%20that%20is%20specifically%20designed%20for%20the%20job.%20You%20can%20try%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fadmindroid.com%2F%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAdminDroid%20Office%20365%20Reporter%3C%2FA%3E%3C%2FSTRONG%3E%20to%20get%20actual%20last%20login%20time%20for%26nbsp%3Beach%20service.%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CH4%20id%3D%22toc-hId-1343225145%22%20id%3D%22toc-hId-1343225145%22%20id%3D%22toc-hId-1343225145%22%20id%3D%22toc-hId-1343225145%22%20id%3D%22toc-hId-1343225145%22%20id%3D%22toc-hId-1343225145%22%3ELast%20Active%20Time%20of%20Users%20by%20Office%20365%20Services%3A%3C%2FH4%3E%3CDIV%3EThis%20report%20will%20show%20the%20user's%20last%20active%20in%20O365%20services%20like%20Exchange%2C%20OneDrive%2C%20SharePoint%2C%20Skype%2C%20Yammer%20and%20Teams.%3C%2FDIV%3E%3CDIV%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F114164iACEBF287FE30817F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22MicrosoftTeams-image.png%22%20title%3D%22MicrosoftTeams-image.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CH4%20id%3D%22toc-hId--1208931816%22%20id%3D%22toc-hId--1208931816%22%20id%3D%22toc-hId--1208931816%22%20id%3D%22toc-hId--1208931816%22%20id%3D%22toc-hId--1208931816%22%20id%3D%22toc-hId--1208931816%22%3EUser's%20Last%20Lagon%20Time%3A%3C%2FH4%3E%3CDIV%3EThis%20report%20shows%20last%20logon%20time%20in%20Azure%20AD.%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20939px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F114165iEF4E10126987BF55%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22MicrosoftTeams-image%20(1).png%22%20title%3D%22MicrosoftTeams-image%20(1).png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-744518%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-744518%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F295378%22%20target%3D%22_blank%22%3E%40Kathy_Cooper%3C%2FA%3E%26nbsp%3BNot%20true%20I'm%20afraid.%20Get-MailboxStats%20shows%20the%20last%20time%20a%20Mailbox%20was%20%22fettled%22%20by%20either%20a%20user%2C%20or%20critically%2C%20Exchange%20(Database%20Services%20or%20Discovery%20Services).%20Therefore%20the%20last%20logon%20date%20of%20a%20mailbox%20will%20be%20inaccurate.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20for%20AdminDroid%2C%20it's%20slow%2C%20clunky%2C%20and%20costs%20money%20if%20you%20want%20any%20of%20the%20decent%20premium%20features.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20appreciate%20that%20MS%20want%20to%20cream%20money%20from%20tenants%20by%20hoping%20the%20keep%20users%20active%2C%20and%20therefore%2C%20paying%20for%20a%20licence%2C%20but%20there%20should%20be%20an%20easy%20to%20find%20report%20that%20shows%20users%20who%20have%20not%20authenticated%20against%20Azure%20or%20O365%20for%20x%20number%20of%20days%2C%20either%20through%20the%20GUI%20or%20PS%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-746785%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-746785%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F373270%22%20target%3D%22_blank%22%3E%40BearCub2019%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EYou%20are%20right.%20I%20have%20seen%20similar%20comments%20in%20my%20blog%20post.%20So%20decided%20to%20dig%20Get-MailboxStatistics%20cmdlet%20more.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EFrom%20that%2C%20I%20found%20a%20reliable%20way%20to%20get%20'real'%20users'%20last%20activity%20on%20Exchange%20mailbox.%20Instead%20of%20LastLogonTime%2C%20I%20have%20used%20LastUserActionTime(Which%20gets%20updated%20only%20for%20'real'%20user's%20actions).%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EI%20have%20posted%20an%20updated%20version%20of%20the%20script%20here%3A%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20title%3D%22https%3A%2F%2Fo365reports.com%2F2019%2F06%2F18%2Fexport-office-365-users-real-last-logon-time-report-csv%2F%22%20href%3D%22https%3A%2F%2Fo365reports.com%2F2019%2F06%2F18%2Fexport-office-365-users-real-last-logon-time-report-csv%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EExport%20Office%20365%20Inactive%20Users%20Report%3C%2FA%3E%3CBR%20%2F%3E%3CSPAN%3ENote%3A%20This%20script%20focuses%20on%20users'%20activity%20in%20Exchange%20Online.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-746788%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-746788%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F373270%22%20target%3D%22_blank%22%3E%40BearCub2019%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EYou%20are%20right.%20I%20have%20seen%20similar%20comments%20in%20my%20blog%20post.%20So%20decided%20to%20dig%20Get-MailboxStatistics%20cmdlet%20more.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EFrom%20that%2C%20I%20found%20a%20reliable%20way%20to%20get%20'real'%20users'%20last%20activity%20on%20Exchange%20mailbox.%20Instead%20of%20LastLogonTime%2C%20I%20have%20used%20LastUserActionTime(Which%20gets%20updated%20only%20for%20'real'%20user's%20actions).%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EI%20have%20posted%20an%20updated%20version%20of%20the%20script%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fo365reports.com%2F2019%2F06%2F18%2Fexport-office-365-users-real-last-logon-time-report-csv%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EExport%20Office%20365%20Inactive%20Users%20Report%3C%2FA%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3ENote%3A%20This%20script%20focuses%20on%20users'%20activity%20in%20Exchange%20Online.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-746893%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20show%20inactive%20user%20detail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-746893%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F373270%22%20target%3D%22_blank%22%3E%40BearCub2019%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EYou%20are%20right.%20I%20have%20seen%20similar%20comments%20in%20my%20blog%20post.%20So%20decided%20to%20dig%20Get-MailboxStatistics%20cmdlet%20more.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EFrom%20that%2C%20I%20found%20a%20reliable%20way%20to%20get%20'real'%20users'%20last%20activity%20on%20Exchange%20mailbox.%20Instead%20of%20LastLogonTime%2C%20I%20have%20used%20LastUserActionTime(Which%20gets%20updated%20only%20for%20'real'%20user%20actions).%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EI%20have%20posted%20an%20updated%20version%20of%20the%20script%20here%3A%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fo365reports.com%2F2019%2F06%2F18%2Fexport-office-365-users-real-last-logon-time-report-csv%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EExport%20Office%20365%20Inactive%20Users%20Report%3C%2FA%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3ENote%3A%20This%20script%20focuses%20on%20users'%20activity%20in%20Exchange%20Online.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Highlighted
Julian Knight
Contributor

I need to be able to report on users who have not been active for more than 180 days. I also need to drill down to be able to list the individual users and their last activity date.

 

How can this be achieved?

9 Replies

Hi Julian,

 

There are various powershell scripts about. I'm currently browsing for one which looks trustworthy. It amazes me that there isn't a standard report in 365 to show this though!

 

Pete

Hi Pete, yes and not a single response from anyone in Microsoft - which is my experience of over 3 years of trying to raise this issue with them both directly and via forums like this.

 

Clearly there is no way to actually produce this information and that creates a real risk to using O365. It should be this report that people use to ensure that inactive accounts are shut down, not leaving them open for abuse.

Julian,

 

I've just used this one. I was hoping to get a csv export but this at least listed the mailboxes I was after: https://community.spiceworks.com/how_to/104316-list-inactive-users-in-office-365

 

Regards,

 

Pete

Unfortunately, that has the common issue that it ONLY looks at mailbox logins and is based on Exchange data. 

 

Microsoft seem unable to realise that not everyone is using Exchange Online and that logins may occur for different reasons.

 

The most reliable method I've found so far requires you to run a complex script against the combined audit log. Last time I ran it, it took over 10 hours against 7k accounts.

 

If Exchange Online logins are a reliable measure of user activity in your case then you will be fine and there are plenty of examples of scripts to do what you want.

@Julian Knight 

I'd suggest using below script for getting Office 365 Inactive users with last logon time, Inactive days, Mailbox type, Assigned license and Admin roles.

Export Office 365 Inactive Users 

 

Script Highlights:

  • Result can be filtered based on inactive days.
  • Result can be filtered based on user / mailbox type.
  • Result can be filtered to lists never logged in mailbox alone.
  • Export results to CSV file.
  • Shows result with user’s administrative roles in O365 environment.
  • The assigned licenses column will show you the user-friendly-name like 'Office 365 Enterprise E3' rather than 'ENTERPRISEPACK'.

@Kathy_Cooper 

 

Hi Kathy, thanks for your response but this does NOT answer the question I'm afraid. This script, like the others mentioned only reports when users last logged into their Exchange Online mailboxes.

 

That is far from being the only service on Office 365 and if the user is not using their mailbox but is using other aspects of Office 365, this will result in an incorrect report.

 

I have yet to find any reliable way to understand inactive users without having to grab the detailed combined log and aggregating it over the number of days you need to check (unless the number of days is less than the available log data).

 

This remains a major security failing of Office 365 since there is no simple way to find truly inactive users and suspend them as best practice would suggest.

@Julian Knight 

Yes, Get-mailboxStatistics shows the time a user last accessed their mailbox.

As you said, exact login time can be retrieved from Search-UnifiedAuditLog, which requires analysis of extensive data. I'd suggest using a tool that is specifically designed for the job. You can try AdminDroid Office 365 Reporter to get actual last login time for each service.
 

Last Active Time of Users by Office 365 Services:

This report will show the user's last active in O365 services like Exchange, OneDrive, SharePoint, Skype, Yammer and Teams.
MicrosoftTeams-image.png
 

User's Last Lagon Time:

This report shows last logon time in Azure AD.MicrosoftTeams-image (1).png

@Kathy_Cooper Not true I'm afraid. Get-MailboxStats shows the last time a Mailbox was "fettled" by either a user, or critically, Exchange (Database Services or Discovery Services). Therefore the last logon date of a mailbox will be inaccurate. 

 

As for AdminDroid, it's slow, clunky, and costs money if you want any of the decent premium features.

 

I appreciate that MS want to cream money from tenants by hoping the keep users active, and therefore, paying for a licence, but there should be an easy to find report that shows users who have not authenticated against Azure or O365 for x number of days, either through the GUI or PS

@BearCub2019 

You are right. I have seen similar comments in my blog post. So decided to dig Get-MailboxStatistics cmdlet more.
 
From that, I found a reliable way to get 'real' users' last activity on Exchange mailbox. Instead of LastLogonTime, I have used LastUserActionTime(Which gets updated only for 'real' user actions).
 
I have posted an updated version of the script here: Export Office 365 Inactive Users Report
Note: This script focuses on users' activity in Exchange Online.
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
35 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies