User sign-in mailbox log

%3CLINGO-SUB%20id%3D%22lingo-sub-1125640%22%20slang%3D%22en-US%22%3EUser%20sign-in%20mailbox%20log%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1125640%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20need%20a%20report%20for%20user%20log-in%2Flog-out%20mailbox%20time.%20Is%20it%20possible%20to%20get%20it%20on%20admin%20portal%3F%20We%20want%20to%20get%20report%20for%20a%20specific%20user%20whose%20log-in%20and%20log%20out%20his%2Fher%20mailbox%20time.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPlease%20help!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1125640%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1125748%22%20slang%3D%22en-US%22%3ERe%3A%20User%20sign-in%20mailbox%20log%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1125748%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F74422%22%20target%3D%22_blank%22%3E%40Grace%20Yin%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20get%20the%20user%20sign%20in%20to%20the%20mailbox%20from%20the%20audit%20log%20in%20the%20Office%20365%20security%20and%20compliance%20centre%20(under%20Exchange%20Online%20section)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F166891i22FC7D31386BA824%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22SCC1.PNG%22%20title%3D%22SCC1.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHope%20that%20answers%20your%20question!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBest%2C%20Chris%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1125905%22%20slang%3D%22en-US%22%3ERe%3A%20User%20sign-in%20mailbox%20log%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1125905%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F169605%22%20target%3D%22_blank%22%3E%40Christopher%20Hoard%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Chris%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20for%20your%20reply.%20I%20have%20tried%20it%2C%20I%20selected%20%22User%20signed%20in%20to%20mailbox%22%2C%20but%20the%20result%20is%20%22no%20data%20available.%22%20If%20I%20search%20other%20activities%2C%20I%20got%20results.%20What%20could%20be%20the%20problem%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1126786%22%20slang%3D%22en-US%22%3ERe%3A%20User%20sign-in%20mailbox%20log%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1126786%22%20slang%3D%22en-US%22%3E%3CP%3EYou'll%20need%20to%20expand%20the%20date%20range.%20With%20Modern%20authentication%2C%20clients%20rarely%20do%20a%20%22full%22%20login%2C%20they%20just%20reuse%20the%20existing%20token%20so%20the%20number%20of%20login%20events%20can%20be%20very%20limited.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhat%20exactly%20are%20you%20trying%20to%20achieve%20here%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1127259%22%20slang%3D%22en-US%22%3ERe%3A%20User%20sign-in%20mailbox%20log%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1127259%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F74422%22%20target%3D%22_blank%22%3E%40Grace%20Yin%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMailbox%20sign-in%20activities%20are%20not%20audited%20by%20default.%20You%20need%20to%20enable%20mailbox%20auditing%20for%20'MailboxLogin'%20operation.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20can%20use%20the%20below%20code%20to%20enable%20mailbox%20auditing%20for%20specific%20users.%3CBR%20%2F%3E%3CEM%3ESet-Mailbox%20-Identity%20%3CUSER%20identity%3D%22%22%3E%20-AuditEnabled%20%24true%20-AuditOwner%20MailboxLogin%3C%2FUSER%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CBR%20%2F%3EOr%20you%20can%20use%20the%20below%20pre-built%20script%20to%20enable%20auditing%20for%20MailboxLogin%2Fall%20mailbox%20actions%20for%20all%20Office%20365%20mailboxes.%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fo365reports.com%2F2020%2F01%2F21%2Fenable-mailbox-auditing-in-office-365-powershell%2F%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EEnable%20Mailbox%20auditing%20for%20Office%20365%20Mailboxes%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Frequent Contributor

Hi,

 

I need a report for user log-in/log-out mailbox time. Is it possible to get it on admin portal? We want to get report for a specific user whose log-in and log out his/her mailbox time.

 

Please help!

 

Thanks in advance!

4 Replies
Highlighted

@Grace Yin 

 

You can get the user sign in to the mailbox from the audit log in the Office 365 security and compliance centre (under Exchange Online section)

 

SCC1.PNG

 

Hope that answers your question!

 

Best, Chris

Highlighted

@Christopher Hoard

 

Hi Chris,

 

Thank you for your reply. I have tried it, I selected "User signed in to mailbox", but the result is "no data available." If I search other activities, I got results. What could be the problem?

 

Thanks,

 

 

Highlighted

You'll need to expand the date range. With Modern authentication, clients rarely do a "full" login, they just reuse the existing token so the number of login events can be very limited.

 

What exactly are you trying to achieve here?

Highlighted

@Grace Yin 

 

Mailbox sign-in activities are not audited by default. You need to enable mailbox auditing for 'MailboxLogin' operation. 

You can use the below code to enable mailbox auditing for specific users.
Set-Mailbox -Identity <User Identity> -AuditEnabled $true -AuditOwner MailboxLogin

Or you can use the below pre-built script to enable auditing for MailboxLogin/all mailbox actions for all Office 365 mailboxes.
Enable Mailbox auditing for Office 365 Mailboxes