Exporting user last login to M365 or Azure to .CSV file ?

@KRANTI KUMAR DANALAKOTA -- Did you find a way to resolve your error?

I could really use a solution for this. i stuck on the same issue

Hi All,

This is due to the user account you are using is not registered under Enterprise Application > Microsoft Graph PowerShell | Users and groups section.

Same error here, adding my user to microsoft graph powershell did not help.

Hi @Donald Flowers , How did you generate that App Secret?

Hi Donald, Where on the script is it required to change the lines? I don’t see the $AppId, $TenantId, and $AppSecret variables in the script.

I have not been able to use this script. I can connect to Graph, get a token, run other basic queries, but when this script evokes some portion of itself, it gets 401 unauthorized error.

I have downloaded the script and this part is not built into the script to change, so where about do we paste them to be able to insert the app id and tennent?

@Chris Newitt @BenJackson

The script Olga Os shared on github has some small, but code-breaking bugs in it. My fixes:

1. Whitespace is removed from the URI
2. The conditional that re-assigned $SignInData is removed
3. First for-loop now iterates on $SignInData.Value
4. Removed column 'created' cuz i didn't need it and it was throwing errors

# The script Olga Os shared on github has some small, 
# but code-breaking bugs in it.
# My fixes:
# Whitespace is removed from the URI
# The conditional that re-assigned $SignInData is removed
# First for-loop now iterates on $SignInData.Value
# Removed column 'created' cuz i didn't need it

Clear-Host

$AppId = "take from azure"
$TenantId = "take from azure"
$AppSecret = 'take from azure'

# Obtain the access token
$body = @{
    grant_type    = "client_credentials"
    scope         = "https://graph.microsoft.com/.default"
    client_id     = $AppId
    client_secret = $AppSecret
}

$tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" -ContentType "application/x-www-form-urlencoded" -Body $body
$accessToken = $tokenResponse.access_token


# Define the headers
$Headers = @{
    "Authorization" = "Bearer $accessToken"
    "Content-Type"  = "application/json"
}

# Get User sign in data
Write-Host "Accessing the Graph to get user sign-in data..."

$URI = "https://graph.microsoft.com/beta/users?`$select=displayName,userPrincipalName,mail,id,CreatedDateTime,signInActivity,UserType&`$top=100"


[array]$SignInData = (Invoke-RestMethod -Method Get -Uri $URI -Headers $Headers  -ContentType "application/json") 


$Report = [System.Collections.Generic.List[Object]]::new() 

ForEach ($User in $SignInData.Value) {  
   [string]$LastSignInOutput = $Null
   If ($Null -ne $User.SignInActivity)     {
      $LastUserSignInDate = $User.SignInActivity['lastSignInDateTime']
      If ($Null -ne $LastUserSignInDate) {
          $LastSignInOutput = Get-Date($LastUserSignInDate) -format g
          $DaysSinceSignIn = (New-TimeSpan $LastUserSignInDate).Days
      }
   } Else { #No sign in data for this user account
      $LastSignInOutput = "Never" 
      $DaysSinceSignIn = "N/A" 
   }
 
   $ReportLine  = [PSCustomObject] @{          
     UPN                = $User.UserPrincipalName
     DisplayName        = $User.DisplayName
     Email              = $User.Mail
     ObjectId           = $User.Id     
     LastSignIn         = $LastSignInOutput
     DaysSinceSignIn    = $DaysSinceSignIn
     UserType           = $User.UserType }
   $Report.Add($ReportLine) 
} # End ForEach

# Do we have extra data to fetch?
$NextLink = $SignInData.'@odata.nextLink'


While ($Null -ne $NextLink) { # We do... so process them.
   Write-Host "Still processing..."
   $SignInData = Invoke-WebRequest -Method GET -Uri $NextLink -ContentType "application/json" -Headers $Headers
   $SignInData = $SignInData | ConvertFrom-JSon
   ForEach ($User in $SignInData.Value) {  
      [string]$LastSignInOutput = $Null
      If ($Null -ne $User.SignInActivity)     {
         $LastUserSignInDate = $User.SignInActivity.LastSignInDateTime
         If ($Null -ne $LastUserSignInDate) {
            $LastSignInOutput = Get-Date($LastUserSignInDate) -format g
            $DaysSinceSignIn = (New-TimeSpan $LastUserSignInDate).Days
        }
      } Else { #No sign in data for this user account
         $LastSignInOutput = "Never" 
         $DaysSinceSignIn = "N/A" 
      }
     
   $ReportLine  = [PSCustomObject] @{  
     UPN                = $User.UserPrincipalName
     DisplayName        = $User.DisplayName
     Email              = $User.Mail
     ObjectId           = $User.Id    
     LastSignIn         = $LastSignInOutput
     DaysSinceSignIn    = $DaysSinceSignIn
     UserType           = $User.UserType        }
   
   $Report.Add($ReportLine) } 

   # Check for more data
   $NextLink = $SignInData.'@Odata.NextLink'
} # End While

Write-Host "All done. " $Report.Count "accounts processed - output available in c:\Temp\ReportUserSignin.csv."
$Report | Sort-Object DisplayName | Out-GridView
$Report | Export-CSV -NoTypeInformation c:\Temp\ReportUserSignin.csv