Last Logon time

[nimby]

Is there anyway to download via powershell the last login time for all users? Currently I'm using "Get-EXOMailboxStatistics" but this requires you to provide a username and only obtains the stats for this user, the problem being we have over 300,000 users so this takes nearly a week to run!!!!!

[#2]

The data you get from Get-MailboxStatistics is incorrect anyway, you shouldn't use that. Use the built-in reports from the O365 admin center, or the corresponding Graph endpoints. Or the recently introduced /signInActivity endpoint, but that's per user also: https://docs.microsoft.com/en-us/graph/api/resources/signinactivity?view=graph-rest-beta

[#3]

@nimby 

Yes. What Vasil said was correct - LastLogonTime from Get-MailBoxStatistics shows wrong value. 

To get all users last activity time/real last logon time, you can use this script: Export Office 365 users Real Last Logon Time Report to CSV

[#4]

@Vasil Michev 

Thanks for the feedback, obtain the data via the Graph API is fine, the problem is that we need to make a call for each user rather than requesting the info for all users. Is there anyway to do this in bulk and obtain the stats for all users in our Org? The root issue for us is that we need to make a call for each user.

[#5]

@Kathy_Cooper 

Hi Kathy, 

Thanks for your suggestion, but looking at this script I think I will hit the same issue as it looks like it makes a call to O365/Azure for each user:-

Function Get_LastLogonTime 
{ 
 $MailboxStatistics=Get-MailboxStatistics -Identity $upn 

 I'm trying to find a way to request the stats for all users with a single call (or at least not 300,000+ calls)

[#6]

Use the Graph call for the report then, it will give you the data for all users.

[#7]

@Vasil Michev 

I presume this would be a call to the auditLogs/signIns endpoint - but this looks like it's only in beta. Is there the same in pro?

[#8]

@nimby You could compute the last active time based on the data available from graph endpoint.

https://docs.microsoft.com/en-us/graph/api/reportroot-getoffice365activeuserdetail?view=graph-rest-1...

[#9]

@nimby 

I wrote a detailed document on this. The solution returns, DisplayName, UserPrincipleName, LastLogin.

$mailboxes = Get-EXOMailbox -ResultSize Unlimited
$mailboxes | ForEach-Object {
 $mbx = $_
 $mbs = Get-EXOMailboxStatistics -Identity $mbx.UserPrincipalName | Where-Object LastLogonTime -LE (Get-Date).AddDays(-90) | Select DisplayName, LastLogonTime
  if ($mbs.LastLogonTime -ne $null){
        $lt = $mbs.LastLogonTime
  }else{
        $lt = "Normal User" }
 
    New-Object -TypeName PSObject -Property @{
        DisplayName = $mbx.DisplayName
        UserPrincipalName = $mbx.UserPrincipalName
        LastLogonTime = $lt}
}

You can read the complete from my blog: Get Last Logon Time of Office 365 Users PowerShell