Table of Contents
While investigating a malicious user’s activities, you might want to track their previous logins. There’re a few ways to achieve that goal.
Check login activity in Microsoft 365 with GUI
Check login activity in Microsoft 365 with Microsoft Graph
Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"Select-MgProfile beta$userid = (Get-MgUser -UserId '[email protected]').id
Get-MgUser -Userid $userid -Property SignInActivity | Select-Object -ExpandProperty SignInActivity | FL#Output
LastNonInteractiveSignInDateTime : 2/2/2023 2:06:47 AM
LastNonInteractiveSignInRequestId : d8fa780f-c164-4606-b8c1-23d4702af000
LastSignInDateTime : 2/2/2023 2:06:46 AM
LastSignInRequestId : 6830f9e6-5be4-4e7d-a381-1cfbef0fc300
AdditionalProperties : {}$userid = (Get-MgUser -UserId '[email protected]').id
Get-MgUser -UserId $userid -Property SignInActivity |
Select @{Name = 'LastSignInDateTime'; Expression = {$_.SignInActivity.LastSignInDateTime}}#Output
LastSignInDateTime
------------------
2/2/2023 2:06:46 AM$userid = (Get-MgUser -UserId '[email protected]').id
Get-MgUser -UserId $userid -Property SignInActivity |
Select @{Name = 'LastSignIn'; Expression = {$_.SignInActivity.LastSignInDateTime}}, `
@{Name = 'LastNonInteractiveSignIn'; Expression = {$_.SignInActivity.LastNonInteractiveSignInDateTime}}#Output
LastSignIn : 2/2/2023 2:06:46 AM
LastNonInteractiveSignIn : 2/2/2023 2:06:47 AMGet the last login date and time for all users
$userids = Get-MgUser -All | Select-Object Id, DisplayName, UserPrincipalName
$Report=@()
ForEach($userid in $userids) {
Write-Host "Checking the last sign-in for: $($userid.UserPrincipalName)" -ForegroundColor Yellow
$llt = Get-MgUser -UserId $userid.Id -Property SignInActivity |
Select @{Name = 'LastSignIn'; Expression = {$_.SignInActivity.LastSignInDateTime}}, `
@{Name = 'LastNonInteractiveSignIn'; Expression = {$_.SignInActivity.LastNonInteractiveSignInDateTime}}
$Obj = New-Object -TypeName PSObject -Property $([ordered]@{
"DisplayName" = $userid.DisplayName
"UserName" = $userid.UserPrincipalName
"LastSignIn" = $llt.LastSignIn
"LastNonInteractiveSignIn" = $llt.LastNonInteractiveSignIn
})
$Report+=$Obj
}
$ReportFind Last Logon Time Using Exchange Online PowerShell
Get-MailboxStatistics -Identity [email protected] | Select LastLogonTimePS C:\> Get-MailboxStatistics -Identity [email protected] | Select LastLogonTime
LastLogonTime
-------------
2/4/2023 9:22:34 AMGet-Mailbox -ResultSize Unlimited | Get-MailboxStatistics | Select-Object DisplayName,LastLogonTimePS C:\> Get-Mailbox -ResultSize Unlimited | Get-MailboxStatistics | Select-Object DisplayName,LastLogonTime
DisplayName LastLogonTime
----------- -------------
Ben 2/4/2023 9:22:34 AM
Bon Ben 2/4/2023 2:13:07 PM
Bon Ben 2/4/2023 9:38:07 AM
Chris 2/4/2023 10:35:2...
Info 1/11/2023 2:36:3...
...$Report = Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | `
Get-MailboxStatistics | Select-Object DisplayName,LastLogonTime
$Report | Export-CSV "C:\Report.csv" -NoTypeInformation -Encoding UTF8
