User Last Logon time in Exchange and Sign-in activity at Azure AD portal

%3CLINGO-SUB%20id%3D%22lingo-sub-1384960%22%20slang%3D%22en-US%22%3EUser%20Last%20Logon%20time%20in%20Exchange%20and%20Sign-in%20activity%20at%20Azure%20AD%20portal%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1384960%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20noticed%20that%20User%20Last%20Logon%20time%20showing%20in%20Online%20Exchange%20and%20Sign-in%20activity%20at%20Azure%20AD%20portal%20is%20different.%20Mailbox%20is%20hosted%20in%20O365%20(Hybrid%20Exchange).%20Some%20of%20the%20mailboxes%20don't%20have%20any%20sign-in%20reports%20in%20Azure%20AD%2C%20But%20the%20last%20logon%20date%20is%20showing%20in%20online%20Exchange.%20Is%20there%20any%20difference%20in%20both%20records%3F%20why%20is%20it%20showing%20different%20dates%20and%20times%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1384960%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1385183%22%20slang%3D%22en-US%22%3ERe%3A%20User%20Last%20Logon%20time%20in%20Exchange%20and%20Sign-in%20activity%20at%20Azure%20AD%20portal%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1385183%22%20slang%3D%22en-US%22%3E%3CP%3EThat's%20the%20expected%20behavior%2C%20there%20are%20multiple%20background%20processes%20that%20are%20accessing%20the%20mailbox%2C%20so%20the%20output%20of%20the%20Get-MailboxStatistics%20should%20not%20be%20trusted.%20Tony%20has%20discussed%20this%20in%20detail%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.petri.com%2Fget-mailboxstatistics-cmdlet-wrong%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.petri.com%2Fget-mailboxstatistics-cmdlet-wrong%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1564516%22%20slang%3D%22en-US%22%3ERe%3A%20User%20Last%20Logon%20time%20in%20Exchange%20and%20Sign-in%20activity%20at%20Azure%20AD%20portal%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1564516%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F665738%22%20target%3D%22_blank%22%3E%40Anu_muralidharan%3C%2FA%3E%26nbsp%3B%3CSPAN%3EAzure%20AD%20sign-in%20report%20shows%20all%20the%20interactive%20login%20attempts.%20Whereas%20Exchange%20Online%2FExchange%20Online%20PowerShell%20shows%20the%20last%20login%20time%2C%20which%20also%20gets%20updated%20when%20the%20background%20process%20like%20Mailbox%20Assistant%20accesses%20the%20mailbox.%20So%2C%20it%20won't%20be%20accurate.%3C%2FSPAN%3E%3C%2FP%3E%3CDIV%3EYou%20can%20check%20this%20blog%20for%20more%20detail%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fo365reports.com%2F2019%2F06%2F18%2Foffice-365-users-last-logon-time-incorrect%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fo365reports.com%2F2019%2F06%2F18%2Foffice-365-users-last-logon-time-incorrect%2F%3C%2FA%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

I have noticed that User Last Logon time showing in Online Exchange and Sign-in activity at Azure AD portal is different. Mailbox is hosted in O365 (Hybrid Exchange). Some of the mailboxes don't have any sign-in reports in Azure AD, But the last logon date is showing in online Exchange. Is there any difference in both records? why is it showing different dates and times?

2 Replies

That's the expected behavior, there are multiple background processes that are accessing the mailbox, so the output of the Get-MailboxStatistics should not be trusted. Tony has discussed this in detail here: https://www.petri.com/get-mailboxstatistics-cmdlet-wrong

@Anu_muralidharan Azure AD sign-in report shows all the interactive login attempts. Whereas Exchange Online/Exchange Online PowerShell shows the last login time, which also gets updated when the background process like Mailbox Assistant accesses the mailbox. So, it won't be accurate.