The good thing is that it’s relatively easy to do it using PS. Just think how long it will take to check 100 users, 10,000? yeah not happening. Get Azure AD Last Login Report Using PowerShellĪs I mentioned already, if we want to scale this operation, the GUI is simply not going to cut it. For batch processing, we’ll turn over to trusty Powershell. The GUI is probably preferred when you need to check a handful of users, but as you can see this option is not very scalable. Navigate to -> Azure AD -> User you want to check -> Sign-Ins.There are methods of getting the information that we need, and those 2 methods are the GUI method as well as the Powershell method. That command is Get-AzureADAuditSignInLogs Get Azure AD Last Login Date And Sign-In Activity in Azure Portal

The great thing is that you don’t need to re-invent the wheel because the Azure AD module already has a cmdlet that encompasses all of the information that I mentioned above. The information that is provided is very rich and it’s up to you to choose what suits your needs. You can also add properties to determine the City/State location, device detail such as System OS and what client was being used.

DeviceOS: The operating system of the device.

TokenIssuerType: If the authentication happened in ADFS or Azure AD.

IpAddress: In some instances it will display the public IP, or internal IP.

AppDisplayName: Which app the user was logging into.

IsInteractive: Whether or not the user signed in manually, or if it was through automation.

CreatedDateTime: Date and Time of when the sign-in occurred.

Our report would include something similar to the following: In this instance, we’re going to focus our efforts on compiling an Azure last login report using PowerShell. If you recall, I wrote a previous post to Get Last Logon Date For All Users in Your Domain, but that script is specifically for Onprem Active Directory domain activity. Every so often when I run an audit on my environment, I’m always finding myself needing to check recent activity logs to specifically get Azure AD last login date and sign-in activity.

Azure active log