SOLVED

List all users' last login date

%3CLINGO-SUB%20id%3D%22lingo-sub-204989%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-204989%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20not%20only%20unreliable%2C%20it's%20impossible.%20Get-MailboxStatistics%20only%20returns%20statistics%20for%20mailboxes%2C%20but%20I%20specifically%20need%20logon%20statistics%20for%20people%20who%20do%20not%20have%20mailboxes.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-204043%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-204043%22%20slang%3D%22en-US%22%3E%3CP%3EJust%20a%20warning%20that%20using%20the%20Get-MailboxStatistics%20cmdlet%20to%20get%20this%20information%20is%20highly%20unreliable%20(see%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F64%22%20target%3D%22_blank%22%3E%40Tony%20Redmond%3C%2FA%3E's%20great%20blog%20on%20that%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.petri.com%2Fget-mailboxstatistics-cmdlet-wrong%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.petri.com%2Fget-mailboxstatistics-cmdlet-wrong%3C%2FA%3E).%20The%20Office%20365%20usage%20reports%20is%20really%20the%20better%20answer%20here.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-204017%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-204017%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20about%20users%20who%20don't%20have%20mailboxes%3F%20I%20have%20a%20number%20of%20users%20for%20whom%20we%20have%20disabled%20the%20Exchange%20Online%20license.%20How%20can%20I%20get%20their%20logon%20statistics%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-192371%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-192371%22%20slang%3D%22en-US%22%3E%3CP%3EOnce%20you've%20logged%20in%20and%20authenticated%20against%20your%20Office%20365%20tenant%2C%20you%20can%20then%20use%20the%20below%20commands.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%23%20Connects%20you%20to%20Windows%20Azure%20Active%20Directory%3C%2FP%3E%3CP%3EConnect-MsolService%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%23%20Gets%20Unlicenced%20users%20and%20lists%20the%20%22DisplayName%2C%20LastLogonTime%20and%20LastLogoffTime%22%3C%2FP%3E%3CP%3EGet-MsolUser%20-UnlicensedUsersOnly%20%7C%20Foreach%20%7BGet-MailboxStatistics%20%24_.UserPrincipalName%20%7C%20Select%20DisplayName%2C%20LastLogonTime%2C%20LastLogoffTime%7D%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-192357%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-192357%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Robert%2C%3C%2FP%3E%3CP%3EI%20tested%20the%20script%20it%20also%20provides%20the%20logon%20times%20for%20%22Unlicensed%20Users%22%20as%20well%20and%20exports%20them%20to%20a%20.CSV.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-192334%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-192334%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20provided%20script%20gives%20you%20the%20last%20login%20information%20of%20users%20who%20have%20Exchange%20Online%20license%20whereas%20the%20requirement%20is%20to%20display%20%22last%20logon%20time%22%20of%20unlicensed%20users%20as%20well.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-192290%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-192290%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20might%20give%20you%20what%20you're%20after...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fcommunity.spiceworks.com%2Fscripts%2Fshow%2F2290-last-log-in-time-and-date-powershell-script-for-office-365-to-desktop-csv-file%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcommunity.spiceworks.com%2Fscripts%2Fshow%2F2290-last-log-in-time-and-date-powershell-script-for-office-365-to-desktop-csv-file%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-130901%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-130901%22%20slang%3D%22en-US%22%3E%3CP%3EI%20think%20this%20is%20what%20you%20need.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20890px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F24653iDD88CE951BF2E97A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Login%20Activities.JPG%22%20title%3D%22Login%20Activities.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20above%20functionality%20is%20available%26nbsp%3Bin%20%3CA%20href%3D%22https%3A%2F%2Fadmindroid.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EAdminDroid%20Office%20365%20Reporter%3C%2FA%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-109987%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-109987%22%20slang%3D%22en-US%22%3EThanks%2C%20Vasil.%20That%20will%20have%20to%20do%2C%20but%20what%20I%20really%20needed%20was%20to%20be%20able%20to%20sort%20on%20user%20type%20(internal%20user%2C%20guest%20user%2C%20administrator%20etc.)%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-109654%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-109654%22%20slang%3D%22en-US%22%3E%3CP%3ENo.%20Use%20the%20report%20in%20the%20O365%20admin%20center%20-%26gt%3B%20Reports%20-%26gt%3B%20Usage%20-%26gt%3B%20Active%20users.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1324618%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1324618%22%20slang%3D%22en-US%22%3Eor%20Get-AzureADAuditSignInLogs%20(AzureADPreview)%20or%20Search-UnifiedAuditLog%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1325063%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1325063%22%20slang%3D%22en-US%22%3EThis%20is%20now%20available%20native%20through%20the%20Graph%20API%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fuser-list%3Fview%3Dgraph-rest-beta%26amp%3Btabs%3Dhttp%23example-5-list-the-last-sign-in-time-of-users-in-a-specific-time-range%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fuser-list%3Fview%3Dgraph-rest-beta%26amp%3Btabs%3Dhttp%23example-5-list-the-last-sign-in-time-of-users-in-a-specific-time-range%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1325989%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1325989%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F7507%22%20target%3D%22_blank%22%3E%40Robert%20Luck%3C%2FA%3E%2C%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20this%20a%20secure%20tool%3F%20Since%20you%20are%20giving%20access%20to%20your%20whole%20organization.%3C%2FP%3E%3CP%3EI%20cannot%20seem%20to%20find%20the%20type%20of%20report%20I%20want%20in%20Azure%20reporting%20so%20I%20am%20thinking%20if%20investing%20is%20tool%20such%20as%20this%20one%2C%20is%20a%20smart%20investment..%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1339862%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1339862%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F631322%22%20target%3D%22_blank%22%3E%40ManjaMso1%3C%2FA%3E%26nbsp%3BYes%2C%20please%20check%20the%20blog%20to%20%3CA%20href%3D%22https%3A%2F%2Fblog.admindroid.com%2Fmanage-your-office-365-reporting-securely-with-admindroid%2F%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Eknow%20more%20about%20the%20security%20implementation%3C%2FA%3E.%20Also%2C%20if%20you%20have%20any%20other%20queries%2C%20feel%20free%20to%20%3CA%20href%3D%22https%3A%2F%2Fadmindroid.com%2Fsupport%23support-request%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ereach%20out%20to%20us%3C%2FA%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1353987%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1353987%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20doesnt%20seem%20to%20work%20for%20me.%20When%20i%20try%20using%20it%20i%20either%20get%20this%20error%3A%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%22error%22%3A%20%7B%3CBR%20%2F%3E%22code%22%3A%20%22Authentication_RequestFromUnsupportedUserRole%22%2C%3CBR%20%2F%3E%22message%22%3A%20%22User%20is%20not%20in%20the%20allowed%20roles%22%2C%3CBR%20%2F%3E%22innerError%22%3A%20%7B%3CBR%20%2F%3E%22request-id%22%3A%20%220119ef60-c3bb-40c1-8f58-7f201bf6d8da%22%2C%3CBR%20%2F%3E%22date%22%3A%20%222020-05-01T21%3A46%3A51%22%3CBR%20%2F%3E%7D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20checked%20i%20am%20global%20admin%20and%20part%20of%20the%20security%20reader%20groups.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOr%20the%20command%20does%20work%2C%20but%20the%20results%20are%20returned%20with%20no%20logon%20dates.%20Have%20you%20had%20any%20luck%20getting%20to%20work%20%3F%20recently%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERobert%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1354064%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1354064%22%20slang%3D%22en-US%22%3E%3CP%3EOne%20other%20Note%3A%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20i%20run%20this%20URL%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fusers%3F%24select%3DdisplayName%2CuserPrincipalName%2CsignInActivity%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fusers%3F%24select%3DdisplayName%2CuserPrincipalName%2CsignInActivity%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFrom%20here%3A%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fuser-list%3Fview%3Dgraph-rest-beta%26amp%3Btabs%3Dhttp%23code-try-21%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fuser-list%3Fview%3Dgraph-rest-beta%26amp%3Btabs%3Dhttp%23code-try-21%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAfter%20First%20selecting%20%22Try%20it%22%20next%20to%20the%20code.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThen%20selecting%20V%201.0%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20shows%20me%20users%20that%20are%20not%20in%20my%20tenant%2C%20that%20have%20never%20been%20in%20my%20tenant%2C%20and%20a%20tenant%20name%20that%20has%20never%20been%20mine.%20Just%20an%20FYI%20on%20that.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERobert%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1354484%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1354484%22%20slang%3D%22en-US%22%3EHI%20Robert%3CBR%20%2F%3E%3CBR%20%2F%3EPlease%20take%20the%20following%20steps%3A%3CBR%20%2F%3ENavigate%20to%20%3CA%20href%3D%22https%3A%2F%2Fdeveloper.microsoft.com%2Fen-us%2Fgraph%2Fgraph-explorer%23%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdeveloper.microsoft.com%2Fen-us%2Fgraph%2Fgraph-explorer%23%3C%2FA%3E%3CBR%20%2F%3EClick%20on%20the%20left%20'signin%20with%20microsoft'.%20sign-in%20with%20your%20global%20administrator%20account.%3CBR%20%2F%3E%3CBR%20%2F%3EThen%20click%20modify%20permission%20(on%20the%20left)%20and%20add%20User.ReadBasic.All%20permission%3CBR%20%2F%3E%3CBR%20%2F%3EIF%20you%20then%20run%20the%20query%3A%3CBR%20%2F%3EGET%20%3CA%20href%3D%22https%3A%2F%2Fgraph.microsoft.com%2Fbeta%2Fusers%3F%24select%3DdisplayName%2CuserPrincipalName%2CsignInActivity%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgraph.microsoft.com%2Fbeta%2Fusers%3F%24select%3DdisplayName%2CuserPrincipalName%2CsignInActivity%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20will%20get%20it.%3CBR%20%2F%3EYOu%20should%20run%20it%20in%20beta%2C%20not%20v1%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20were%20trying%20the%20graph%20explorer%20without%20signing-in%20and%20then%20it%20uses%20sample%20data%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1354878%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1354878%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAhh!!%20Ok%20that%20makes%20sense.%20I%20will%20try%20your%20solution.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERobert%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1354882%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1354882%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOk%20that%20worked!%20Thanks%20for%20your%20assistance.%20Now%20how%20can%20i%20see%20all%20the%20users%20in%20the%20tenant%3F%20I%20am%20testing%20with%20my%20own%20tenant%20which%20only%20has%20about%2020%20users%2C%20so%20can%20i%20assume%20that%20if%20i%20run%20the%20above%20query%20on%20a%20larger%20tenant%20that%20it%20will%20just%20return%20all%20users%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%2C%20How%20long%20does%20the%20logging%20go%20back%20for%20%3F%20is%20the%20standard%20Windows%20Azure%2090%20Days%3F%20Can%20i%20access%20Microsoft%20Graph%20using%20Excel%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%26nbsp%3B%3C%2FP%3E%3CP%3ERobert%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1354903%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1354903%22%20slang%3D%22en-US%22%3EYou%20could%20use%20a%20for%20each%20loop%20to%20check%20all%20the%20users%20in%20the%20tenant.%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20you%20are%20new%20to%20Microsoft%20Graph%2C%20I%20recommend%20reading%20this%20article%20to%20learn%20more%20about%20it%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdeveloper.microsoft.com%2Fen-us%2Fgraph%2Fblogs%2Fannouncing-30-days-of-microsoft-graph-blog-series%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdeveloper.microsoft.com%2Fen-us%2Fgraph%2Fblogs%2Fannouncing-30-days-of-microsoft-graph-blog-series%2F%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1359373%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1359373%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F78937%22%20target%3D%22_blank%22%3E%40Robert%20Bollinger%3C%2FA%3E%26nbsp%3BHow%20to%20get%20this%20out%20in%20a%20CSV%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1448619%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1448619%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETrying%20to%20sing%20in%20to%20Graph%20Explorer%20and%20get%20an%20error%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%20class%3D%22row%20text-title%22%3ESign%20in%3C%2FDIV%3E%3CDIV%20class%3D%22row%20text-body%22%3E%3CP%20class%3D%22text-block-body%20no-margin-top%22%3ESorry%2C%20but%20we%E2%80%99re%20having%20trouble%20signing%20you%20in.%3C%2FP%3E%3C%2FDIV%3E%3CDIV%20class%3D%22row%20text-body%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22row%20text-body%22%3EAADSTS50011%3A%20The%20reply%20URL%20specified%20in%20the%20request%20does%20not%20match%20the%20reply%20URLs%20configured%20for%20the%20application%3A%20'de8bc8b5-d9f9-48b1-a8ad-b748da725064'.%20More%20details%3A%20Reply%20address%20did%20not%20match%20because%20of%20case%20sensitivity.%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1448632%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1448632%22%20slang%3D%22en-US%22%3EIs%20this%20the%20first%20time%20you%20are%20trying%20to%20use%20the%20graph%20explorer%3F%3CBR%20%2F%3EWhat%20kind%20of%20permissions%20do%20you%20have%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1448694%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1448694%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20having%20this%20issue%20ever%20since%20they%20GAd%20the%20%22preview%22%20version%2C%20even%20opened%20a%20GitHub%20issue%20on%20it.%20Removing%2Freconsenting%20to%20the%20explorer%20app%20did%20nothing%20in%20my%20case%2C%20and%20moreover%20why%20the%20hell%20should%20case%20sensitivity%20matter...%20Programmers!%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1450615%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1450615%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYes%2C%20first%20time%20trying%20to%20login.%20i'm%20one%20and%20only%20Global%20Admin%20at%20my%20tenant.%20Can%20this%20issue%20be%20connected%20to%20tenant%20type%3F%20I%20mean%20does%20it%20matter%20Corporate%20licence%20or%20Personal%20licence%20tenant%20belong%20to%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1450710%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1450710%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F513410%22%20target%3D%22_blank%22%3E%40aero2466%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20shouldn't%20matter.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20the%20fact%20that%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3Bhas%20the%20same%20issue%2C%20suggests%20that%20it's%20a%20global%20issue.%3C%2FP%3E%3CP%3EVasil%2C%20could%20you%20link%20the%20Github%20issue%20you%20created%20please%3F%3C%2FP%3E%3CP%3EMaybe%20aero%20can%20share%20his%20experience%20as%20well%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1451576%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1451576%22%20slang%3D%22en-US%22%3E%3CP%3ENobody%20bothered%20to%20even%20look%20at%20it%20for%2020%20days%2C%20but%20sure%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmicrosoftgraph%2Fmicrosoft-graph-explorer%2Fissues%2F422%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2Fmicrosoftgraph%2Fmicrosoft-graph-explorer%2Fissues%2F422%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-109212%22%20slang%3D%22en-US%22%3EList%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-109212%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20it%20possible%2C%20using%20PowerShell%2C%20to%20list%20all%20AAD%20users'%20last%20login%20date%20(no%20matter%20how%20they%20logged%20in)%3F%20I%20have%20found%20a%20couple%20of%20scripts%20that%20check%20the%20last%20mailbox%20login%2C%20but%20that%20is%20not%20what%20we%20need%2C%20because%20we%26nbsp%3Balso%20want%20to%20list%20unlicensed%20users.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-109212%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Elogin%20date%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2043584%22%20slang%3D%22en-US%22%3ERe%3A%20List%20all%20users'%20last%20login%20date%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2043584%22%20slang%3D%22en-US%22%3EI%20personally%20prefer%20Joshua's%20solution.%20Just%20make%20a%20connection%20to%20AzureAD%20with%20Connect-AzureAD%20using%20the%20preview%20version%20of%20the%20module%2C%20then%20run%20a%20query%20using%20the%20objectid%20or%20upn%20as%20follows.%20The%20%22-Top%201%22%20gives%20you%20the%20most%20recent%20login.%3CBR%20%2F%3E%23%20upn%3CBR%20%2F%3EGet-AzureADAuditSignInLogs%20-Filter%20%22UserPrincipalName%20eq%20'%24userPrincipalName'%22%20-Top%201%20%7C%20Select%20-ExpandProperty%20CreatedDateTime%3CBR%20%2F%3E%23%20objectid%3CBR%20%2F%3EGet-AzureADAuditSignInLogs%20-Filter%20%22UserId%20eq%20'%24objectId'%22%20-Top%201%20%7C%20Select%20-ExpandProperty%20CreatedDateTime%3C%2FLINGO-BODY%3E
Frequent Contributor

Is it possible, using PowerShell, to list all AAD users' last login date (no matter how they logged in)? I have found a couple of scripts that check the last mailbox login, but that is not what we need, because we also want to list unlicensed users.

36 Replies
You could use a for each loop to check all the users in the tenant.

If you are new to Microsoft Graph, I recommend reading this article to learn more about it:
https://developer.microsoft.com/en-us/graph/blogs/announcing-30-days-of-microsoft-graph-blog-series/

@Robert Bollinger How to get this out in a CSV?

@Thijs Lecomte 

Trying to sing in to Graph Explorer and get an error:

 

Sign in

Sorry, but we’re having trouble signing you in.

 
AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: 'de8bc8b5-d9f9-48b1-a8ad-b748da725064'. More details: Reply address did not match because of case sensitivity.
Is this the first time you are trying to use the graph explorer?
What kind of permissions do you have?

I'm having this issue ever since they GAd the "preview" version, even opened a GitHub issue on it. Removing/reconsenting to the explorer app did nothing in my case, and moreover why the hell should case sensitivity matter... Programmers! :)

@Thijs Lecomte 

 

Yes, first time trying to login. i'm one and only Global Admin at my tenant. Can this issue be connected to tenant type? I mean does it matter Corporate licence or Personal licence tenant belong to?

@aero2466 

It shouldn't matter.

 

But the fact that @Vasil Michev has the same issue, suggests that it's a global issue.

Vasil, could you link the Github issue you created please?

Maybe aero can share his experience as well

Nobody bothered to even look at it for 20 days, but sure: https://github.com/microsoftgraph/microsoft-graph-explorer/issues/422

I personally prefer Joshua's solution. Just make a connection to AzureAD with Connect-AzureAD using the preview version of the module, then run a query using the objectid or upn as follows. The "-Top 1" gives you the most recent login.
# upn
Get-AzureADAuditSignInLogs -Filter "UserPrincipalName eq '$userPrincipalName'" -Top 1 | Select -ExpandProperty CreatedDateTime
# objectid
Get-AzureADAuditSignInLogs -Filter "UserId eq '$objectId'" -Top 1 | Select -ExpandProperty CreatedDateTime

@Jakob Rohde this is a classic Microsoft 365 housekeeping task and question. A pity Microsoft is not offering something out of the box.

 

I would suggest following Powershell script, which returns not only your users last login date as CSV file, but also assigned licenses. This way you may check whether there is someone not logging in and consuming licenses.

 

 

 

Install-Module AzureADPreview -AllowClobber -Force

Connect-AzureAD

$usersexport = [system.collections.arraylist]@()

Get-AzureADUser | % {
    $User = $_
    $UPN = $User.UserPrincipalName
    
    Write-Output "Start analysing $UPN"

    $LoginTime = Get-AzureAdAuditSigninLogs -top 1 -filter "userprincipalname eq '$UPN'" | select CreatedDateTime
    $Licenses = Get-AzureADUserLicenseDetail -ObjectId $User.ObjectId | % { $_.ServicePlans | Where {$_.AppliesTo -eq "User"}} | select -ExpandProperty ServicePlanName
    
    $Export = [pscustomobject]@{
        'DisplayName' = $User.DisplayName; 
        'UserPrincipalName' = $UPN;
        'LastSignInDate' = $LoginTime.CreatedDateTime;
        'Licenses' = $Licenses -join ",";
    }
    
    $usersexport.Add($Export)
    
    Write-Output $Export
}
$usersexport | Export-CSV $Home\LastLogonDate.csv

 

 

 

@Staniko 

Thank you for the above, looks exactly what I need but am getting the following error when running an elevated ISE PowerShell window:

 

Get-AzureAdAuditSigninLogs : The term 'Get-AzureAdAuditSigninLogs' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
again.
At line:9 char:18
+ $LoginTime = Get-AzureAdAuditSigninLogs -top 1 -filter "userprinc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Get-AzureAdAuditSigninLogs:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

Any ideas? :)

@jjdmsgc Did the module install correctly? Did you run Powershell as admin? What does the command  

Install-Module AzureADPreview -AllowClobber -Force

 return? 

Ran and installed fine, then signed in with a global admin account for the tenancy I want to run it on and script fails on that line.

When I remove that line it runs and exports the information minus the login info etc. so problem is local to that line! :( Thank you for the swift reply.

@jjdmsgc seems to be an ISE issue, try it with the normal powershell window.

 

The command reference, just in case:

https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureadauditsigninlogs?view=azureadps...

Found on a Github post:
So solution was to restart Powershell and login to Azure AD using Connect-AzureAD from AzureADPreview module:

AzureADPreview\Connect-AzureAD


After that cmdlet became available.

Get-AzureADAuditSignInLogs returns the events from the last month only, doesn't it? 

@Vadim Dich Well upon checking I noticed that even accounts which for sure where logged in the last month where noted without an last sign-in date in the output.

So after more searching I'm now using the solution found on : GitHub - mzmaili/Get-AzureADUsersLastSignIn: Get-AADUserLastSignIn.ps1 is a PowerShell script retrie...

It's also faster and gives me the correct data i'm looking for.