O365 last logon

[Bupeshkumar Rajendiran]

I am trying to extract 0365 last-logon. is there is any other way other than mailboxstatistics cmdlet in powershell. This command doesnt help me.

Things i have tried.

1. Search-UnifiedAuditLog -StartDate 05/14/2018 -EndDate 08/12/2018 -RecordType AzureActiveDirectoryStsLogon,SharePointFileOperation,Yammer,exchangeitem, exchangeitemgroup -userids $email -resultsize 5000 | Sort-Object creationdate -Descending  | ft operations, userids, creationdate -autosize -Wrap

2. Search-UnifiedAuditLog -UserIDs $SearchMailbox -StartDate $StartTime -EndDate $EndTime -Operations "UserLoggedIn","User signed in to mailbox"

3. download the activity report from portal.

Is there is any other better way to get the last actual logon. thats includes any office365 products.

Is there is any other way trigger the activity report via powershell/ or get data activity data by powershell for a user.

any help will be appreciated.

thanks

[#2]

Those are the methods that expose the correct data. If you are looking to automate it, PowerShell should do the trick, and for the report you can use the Graph API: https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/reportroot_getoffice365activ...

[#3]

Hello Bupeshkumar Rajendiran,

Finding a last-logon using the audit log is quite challenging. If you go with the PowerShell then you need to retrieve all the data and compute the statistics by iterating the result or you may store the data in a database which you can run a query against. Also, note that you can find the last login information only if the user logged in the past 90 days as Microsoft only preserve the audit log for last 90 days by default. Preserving beyond this limit is also quite challenging.

I believe you are looking for a report like this. Instead of developing the solution on your own, the better way is to use the pre-built solution which takes care of preserving the data over the retention limit, timely sync, etc.