How to get Azure AD user's last login time?

Question

I am using the Azure AD Graph client library for .NET to retrieve and manage user accounts. I want to be able to find out the time stamp of the last login by a user. However the object returned from the library is of type Microsoft.Azure.ActiveDirectory.GraphClient.User and does not contain any such property.

I am also unable to see any information related to login time on the Azure Management Console website. The Devices and Activity sections of a users profile are always empty, even for users i know to be active.

Answer 1

Its a shame that Azure doesn't expose last_logon property of the User object,

Even the device entity has such property ( approximateLastLogonTimeStamp )

Answer 2

Completely agree. On-premise AD includes this; it's disappointing that its not easier to get at in Azure AD (AAD).

One option, if your tenant has a P1 or higher AAD license, would be to use the https://graph.microsoft.com/beta/auditLogs/signIns/ endpoint.

You can get more info at https://docs.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-beta .

Answer 3

I know this is a bit late, but this script did it for me:

Get-ADUser -Filter * -Properties LastLogonTimeStamp, whenCreated |

Select-Object Name,SamAccountName, whenCreated,enabled,@{Name="LastLogonDate"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('yyyy-MM-dd hh:mm:ss')}} | Export-Csv -Path C:\Temp\ExportUsers.csv –notypeinformation

Ps this is a powershell script (so not the graph client library).