Jan 23 2020 09:24 AM
Jan 23 2020 11:58 PM
You'll need to expand the date range. With Modern authentication, clients rarely do a "full" login, they just reuse the existing token so the number of login events can be very limited.
What exactly are you trying to achieve here?
Jan 24 2020 04:43 AM
Mailbox sign-in activities are not audited by default. You need to enable mailbox auditing for 'MailboxLogin' operation.
You can use the below code to enable mailbox auditing for specific users.
Set-Mailbox -Identity <User Identity> -AuditEnabled $true -AuditOwner MailboxLogin
Or you can use the below pre-built script to enable auditing for MailboxLogin/all mailbox actions for all Office 365 mailboxes.
Enable Mailbox auditing for Office 365 Mailboxes