Last Logon time

%3CLINGO-SUB%20id%3D%22lingo-sub-1250409%22%20slang%3D%22en-US%22%3ELast%20Logon%20time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1250409%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20anyway%20to%20download%20via%20powershell%20the%20last%20login%20time%20for%20all%20users%3F%20Currently%20I'm%20using%20%22Get-EXOMailboxStatistics%22%20but%20this%20requires%20you%20to%20provide%20a%20username%20and%20only%20obtains%20the%20stats%20for%20this%20user%2C%20the%20problem%20being%20we%20have%20over%20300%2C000%20users%20so%20this%20takes%20nearly%20a%20week%20to%20run!!!!!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1250409%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Estatistics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1251384%22%20slang%3D%22en-US%22%3ERe%3A%20Last%20Logon%20time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1251384%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20data%20you%20get%20from%20Get-MailboxStatistics%20is%20incorrect%20anyway%2C%20you%20shouldn't%20use%20that.%20Use%20the%20built-in%20reports%20from%20the%20O365%20admin%20center%2C%20or%20the%20corresponding%20Graph%20endpoints.%20Or%20the%20recently%20introduced%20%2FsignInActivity%20endpoint%2C%20but%20that's%20per%20user%20also%3A%26nbsp%3B%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fresources%2Fsigninactivity%3Fview%3Dgraph-rest-beta%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fresources%2Fsigninactivity%3Fview%3Dgraph-rest-beta%3C%2FA%3E%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1251821%22%20slang%3D%22en-US%22%3ERe%3A%20Last%20Logon%20time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1251821%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F593437%22%20target%3D%22_blank%22%3E%40nimby%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYes.%20What%20Vasil%20said%20was%20correct%20-%20%3CA%20href%3D%22https%3A%2F%2Fo365reports.com%2F2019%2F06%2F18%2Foffice-365-users-last-logon-time-incorrect%2F%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ELastLogonTime%20from%20Get-MailBoxStatistics%20shows%20wrong%20value%3C%2FA%3E.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETo%20get%20all%20users%20last%20activity%20time%2Freal%20last%20logon%20time%2C%20you%20can%20use%20this%20script%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fo365reports.com%2F2019%2F06%2F18%2Fexport-office-365-users-real-last-logon-time-report-csv%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EExport%20Office%20365%20users%20Real%20Last%20Logon%20Time%20Report%20to%20CSV%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1252380%22%20slang%3D%22en-US%22%3ERe%3A%20Last%20Logon%20time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1252380%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20feedback%2C%20obtain%20the%20data%20via%20the%20Graph%20API%20is%20fine%2C%20the%20problem%20is%20that%20we%20need%20to%20make%20a%20call%20for%20each%20user%20rather%20than%20requesting%20the%20info%20for%20all%20users.%20Is%20there%20anyway%20to%20do%20this%20in%20bulk%20and%20obtain%20the%20stats%20for%20all%20users%20in%20our%20Org%3F%20The%20root%20issue%20for%20us%20is%20that%20we%20need%20to%20make%20a%20call%20for%20each%20user.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1252414%22%20slang%3D%22en-US%22%3ERe%3A%20Last%20Logon%20time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1252414%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F295378%22%20target%3D%22_blank%22%3E%40Kathy_Cooper%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Kathy%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20your%20suggestion%2C%20but%20looking%20at%20this%20script%20I%20think%20I%20will%20hit%20the%20same%20issue%20as%20it%20looks%20like%20it%20makes%20a%20call%20to%20O365%2FAzure%20for%20each%20user%3A-%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3E%3CSPAN%20class%3D%22powerShell__keyword%22%3EFunction%3C%2FSPAN%3E%26nbsp%3BGet_LastLogonTime%26nbsp%3B%0A%7B%26nbsp%3B%0A%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24MailboxStatistics%3C%2FSPAN%3E%3DGet%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EMailboxStatistics%26nbsp%3B%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EIdentity%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24upn%3C%2FSPAN%3E%26nbsp%3B%3C%2FPRE%3E%3CP%3E%26nbsp%3BI'm%20trying%20to%20find%20a%20way%20to%20request%20the%20stats%20for%20all%20users%20with%20a%20single%20call%20(or%20at%20least%20not%20300%2C000%2B%20calls)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1252868%22%20slang%3D%22en-US%22%3ERe%3A%20Last%20Logon%20time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1252868%22%20slang%3D%22en-US%22%3E%3CP%3EUse%20the%20Graph%20call%20for%20the%20report%20then%2C%20it%20will%20give%20you%20the%20data%20for%20all%20users.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1253036%22%20slang%3D%22en-US%22%3ERe%3A%20Last%20Logon%20time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1253036%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20presume%20this%20would%20be%20a%20call%20to%20the%26nbsp%3B%3CSPAN%3EauditLogs%2FsignIns%20endpoint%20-%20but%20this%20looks%20like%20it's%20only%20in%20beta.%20Is%20there%20the%20same%20in%20pro%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1254624%22%20slang%3D%22en-US%22%3ERe%3A%20Last%20Logon%20time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1254624%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F593437%22%20target%3D%22_blank%22%3E%40nimby%3C%2FA%3E%26nbsp%3BYou%20could%20compute%20the%20last%20active%20time%20based%20on%20the%20data%20available%20from%20graph%20endpoint.%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Freportroot-getoffice365activeuserdetail%3Fview%3Dgraph-rest-1.0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Freportroot-getoffice365activeuserdetail%3Fview%3Dgraph-rest-1.0%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Is there anyway to download via powershell the last login time for all users? Currently I'm using "Get-EXOMailboxStatistics" but this requires you to provide a username and only obtains the stats for this user, the problem being we have over 300,000 users so this takes nearly a week to run!!!!!

7 Replies
Highlighted

The data you get from Get-MailboxStatistics is incorrect anyway, you shouldn't use that. Use the built-in reports from the O365 admin center, or the corresponding Graph endpoints. Or the recently introduced /signInActivity endpoint, but that's per user also: https://docs.microsoft.com/en-us/graph/api/resources/signinactivity?view=graph-rest-beta

Highlighted

@nimby 

Yes. What Vasil said was correct - LastLogonTime from Get-MailBoxStatistics shows wrong value

 

To get all users last activity time/real last logon time, you can use this script: Export Office 365 users Real Last Logon Time Report to CSV

 

 

Highlighted

@Vasil Michev 

 

Thanks for the feedback, obtain the data via the Graph API is fine, the problem is that we need to make a call for each user rather than requesting the info for all users. Is there anyway to do this in bulk and obtain the stats for all users in our Org? The root issue for us is that we need to make a call for each user.

Highlighted

@Kathy_Cooper 

 

Hi Kathy, 

 

Thanks for your suggestion, but looking at this script I think I will hit the same issue as it looks like it makes a call to O365/Azure for each user:-

 

Function Get_LastLogonTime 
{ 
 $MailboxStatistics=Get-MailboxStatistics -Identity $upn 

 I'm trying to find a way to request the stats for all users with a single call (or at least not 300,000+ calls)

 

 

Highlighted

Use the Graph call for the report then, it will give you the data for all users.

Highlighted

@Vasil Michev 

 

I presume this would be a call to the auditLogs/signIns endpoint - but this looks like it's only in beta. Is there the same in pro?

Highlighted

@nimby You could compute the last active time based on the data available from graph endpoint.

https://docs.microsoft.com/en-us/graph/api/reportroot-getoffice365activeuserdetail?view=graph-rest-1...