User Last Logon time in Exchange and Sign-in activity at Azure AD portal

Copper Contributor

I have noticed that User Last Logon time showing in Online Exchange and Sign-in activity at Azure AD portal is different. Mailbox is hosted in O365 (Hybrid Exchange). Some of the mailboxes don't have any sign-in reports in Azure AD, But the last logon date is showing in online Exchange. Is there any difference in both records? why is it showing different dates and times?

2 Replies

That's the expected behavior, there are multiple background processes that are accessing the mailbox, so the output of the Get-MailboxStatistics should not be trusted. Tony has discussed this in detail here:

@Anu_muralidharan Azure AD sign-in report shows all the interactive login attempts. Whereas Exchange Online/Exchange Online PowerShell shows the last login time, which also gets updated when the background process like Mailbox Assistant accesses the mailbox. So, it won't be accurate.