Office 365 Exchange Login Activity Log for Users

%3CLINGO-SUB%20id%3D%22lingo-sub-667916%22%20slang%3D%22en-US%22%3EOffice%20365%20Exchange%20Login%20Activity%20Log%20for%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-667916%22%20slang%3D%22en-US%22%3E%3CP%3EFor%20a%20normal%20Office%20365%20Exchange%20account%2C%20is%20it%20possible%20for%20the%20user%20to%20view%20his%20own%20login%20activity%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20example%2C%20to%20view%20Outlook%20on%20Windows%20laptop%20login%20time%20with%20IP%2C%20Outlook%20on%20Android%20login%20time%20with%2C%20IP%2C%20etc.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20user%20who%20suspects%20his%20account%20has%20been%20used%20from%20somewhere%20without%20his%20knowledge.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe've%20changed%20the%20password%20now%2C%20but%20still%2C%20would%20like%20to%20look%20at%20previous%20activity.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20found%20the%20Audit%20logs%20in%20the%20Exchange%20Admin%20login%2C%20but%20this%20doesn't%20show%20the%20IP%20the%20action%20was%20done%20from%2C%20as%20I%20understand%20it%3F%20Also%2C%20it's%20not%20a%20way%20for%20a%20normal%20user%20to%20use.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-667916%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-668174%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Exchange%20Login%20Activity%20Log%20for%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-668174%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F342387%22%20target%3D%22_blank%22%3E%40famadorian%3C%2FA%3E%26nbsp%3BThe%20Azure%20AD%20activity%20reports%20show%20all%20of%20the%20details%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_IAM%2FUsersManagementMenuBlade%2FSignIns%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_IAM%2FUsersManagementMenuBlade%2FSignIns%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_IAM%2FUsersManagementMenuBlade%2FAudit%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_IAM%2FUsersManagementMenuBlade%2FAudit%3C%2FA%3E.%20End%20users%20can%20be%20granted%20access%2C%20but%20I%20would%20not%20typically%20recommend%20doing%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-671804%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Exchange%20Login%20Activity%20Log%20for%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-671804%22%20slang%3D%22en-US%22%3E%3CP%3EEnd%20users%20will%20soon%20be%20able%20to%20view%20this%20information%20via%20the%20new%20MySignIns%20portal%2C%20which%20you%20can%20get%20a%20glimpse%20at%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Active-Directory-Identity%2FCool-enhancements-to-the-Azure-AD-combined-MFA-and-password%2Fba-p%2F354271%2Fpage%2F2%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Active-Directory-Identity%2FCool-enhancements-to-the-Azure-AD-combined-MFA-and-password%2Fba-p%2F354271%2Fpage%2F2%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20enable%20the%20preview%20today%2C%20but%20for%20some%20reason%20they%20hid%20the%20Recent%20activity%20page%20(you%20can%20still%20browse%20to%20it%20directly%20if%20the%20preview%20is%20enabled).%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-679751%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Exchange%20Login%20Activity%20Log%20for%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-679751%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20also%20available%20if%20we%20only%20have%20Office%20365%3F%20I%20don't%20even%20know%20what%20Azure%20is.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-679975%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Exchange%20Login%20Activity%20Log%20for%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-679975%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F342387%22%20target%3D%22_blank%22%3E%40famadorian%3C%2FA%3EI've%20been%20in%20the%20scenario%20when%20we%20first%20implemented%20O365.%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3EI%20recommend%20reading%20up%20on%20it.%20Azure%20is%20the%20overarching%20cloud%20service%20by%20Microsoft.%20Azure%20AD%20(short%20for%20Azure%20Active%20Directory)%20is%20one%20of%20those%20services%2C%20which%20is%20directly%20tied%20with%20Office%20365.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Factive-directory-whatis%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Factive-directory-whatis%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-680535%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Exchange%20Login%20Activity%20Log%20for%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-680535%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20available%20for%20O365%20as%20well%2C%20but%20is%20still%20in%20preview.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

For a normal Office 365 Exchange account, is it possible for the user to view his own login activity?

 

For example, to view Outlook on Windows laptop login time with IP, Outlook on Android login time with, IP, etc. 

 

I have a user who suspects his account has been used from somewhere without his knowledge. 

 

We've changed the password now, but still, would like to look at previous activity. 

 

I've found the Audit logs in the Exchange Admin login, but this doesn't show the IP the action was done from, as I understand it? Also, it's not a way for a normal user to use. 

6 Replies
Highlighted

@famadorian The Azure AD activity reports show all of the details, https://portal.azure.com/#blade/Microsoft_AAD_IAM/UsersManagementMenuBlade/SignIns and https://portal.azure.com/#blade/Microsoft_AAD_IAM/UsersManagementMenuBlade/Audit. End users can be granted access, but I would not typically recommend doing this.

Highlighted

End users will soon be able to view this information via the new MySignIns portal, which you can get a glimpse at here: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Cool-enhancements-to-the-Azur...

 

You can enable the preview today, but for some reason they hid the Recent activity page (you can still browse to it directly if the preview is enabled).

Highlighted

This is also available if we only have Office 365? I don't even know what Azure is. 

Highlighted

@famadorianI've been in the scenario when we first implemented O365. :)

I recommend reading up on it. Azure is the overarching cloud service by Microsoft. Azure AD (short for Azure Active Directory) is one of those services, which is directly tied with Office 365.

 

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis

Highlighted

It's available for O365 as well, but is still in preview.

Highlighted
I am new to this version