Inconsistent lastSignInDateTime value for some users

Question

If I read (some) users lastSignInDateTime value multiple times I will get randomly two different values.
I use get-mguser or API
I have tested multiple tenants and ~10-20% users are affected in any tenants.

https://graph.microsoft.com/beta/users/4b1f342a-68e5-4ceb-bb01-4db7cf4111a7?Select=SignInActivity

{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#users(signInActivity)/$entity",
"id": "4b1f342a-68e5-4ceb-bb01-4db7cf4111a7",
"signInActivity": {
"lastSignInDateTime": "2022-06-22T13:44:13Z",
"lastSignInRequestId": "d606ed9b-8214-401e-b37a-951b58257900",
"lastNonInteractiveSignInDateTime": "2022-12-06T22:16:53Z",
"lastNonInteractiveSignInRequestId": "edfabc6e-ea23-49b2-9b23-c655f53be700"
}
}
Response headers nr 1
{
"client-request-id": "6e02b151-1a45-135f-01f7-7aef0d6aecfc",
"content-type": "application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=false;charset=utf-8",
"request-id": "3139391b-ab29-4f9f-a907-01915799fc66"
}

I repeat same request and I will get different lastSignInDateTime
Response nr 2
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#users(signInActivity)/$entity",
"id": "4b1f342a-68e5-4ceb-bb01-4db7cf4111a7",
"signInActivity": {
"lastSignInDateTime": "2022-11-24T08:18:15Z",
"lastSignInRequestId": "b1ae0406-b66b-4486-bb46-0f689ab4f800",
"lastNonInteractiveSignInDateTime": "2022-12-06T22:16:53Z",
"lastNonInteractiveSignInRequestId": "edfabc6e-ea23-49b2-9b23-c655f53be700"
}
}
Response headers nr 2
{
"client-request-id": "43705c98-ab14-55b6-ea89-b8a14461d2cd",
"content-type": "application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=false;charset=utf-8",
"request-id": "d700548a-57ff-4c80-b38e-0f0e4f88924c"
}

Answer 1

I have small script to find affected user (script will Get-MgUser 6 times and compare lastSignInDateTime:

Connect-MgGraph  
    
 $Users = Get-MgUser -filter "UserType eq 'Member'" -all -Property SignInActivity | sort UserPrincipalName   
 $Users.Count  
   
 $AffectedUsers = @()  
 $record = ""  
  
 foreach ($i in 1..5)  
    {  
    write-host "Test nt $i"  
    $Users_new = Get-MgUser -filter "UserType eq 'Member'" -all -Property SignInActivity | sort UserPrincipalName   
    foreach ($User_new in $Users_new |select -First 100000)  
        {  
        $User = $Users | where {$_.id -eq $User_new.id}  
        if ($User.SignInActivity.lastSignInDateTime -notlike $User_new.SignInActivity.lastSignInDateTime)  
            {  
              
            $record = $User.UserPrincipalName + "   " + $User.SignInActivity.lastSignInDateTime + " vs. " + $User_new.SignInActivity.lastSignInDateTime  
            $AffectedUsers += $record  
            }  
        }  
  
    }  
  
 $AffectedUsers = $AffectedUsers |sort| select -Unique   
 $AffectedUsers.Count  
 $AffectedUsers  

Answer 2

Thanks for your patient,

First of all, there is 2 types of signinlogs , one is interactive (when user get a pop up and sign in) and another is non-interactive (Where the sign-in happens in backgroup without user interaction) , I tried to repo the same multiple times, this is working as expected , when you login and try to get signinlogs , it will give you the previous signing date when you logged in , and then it takes some time to update the new sign .

Activity log data is ingested in 30 seconds when you use the recommended subscription-level diagnostic settings to send them into Azure Monitor Logs. please see the doc for more info data-ingestion-time

I will explain you the example for interactive user, how it works
As per the below Screenshot i tried 3 times and it gives 3 data (2 for graph and 1 for azure). 1st is when i logged in to the graph explorer and check the signin logs it gives me last sign_in data (previous one), and in the 2nd call, it gives me the current data (after updating the logs with current data),
and 3rd is when i logged in azure portal.

At last, i am getting the same result of last "lastSignInDateTime": "2022-12-14T06:53:06Z", which i did in azure portal, see the below screenshot

I know this become too long but hope it's clear now.

----------

Hope this helps.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have further questions about this answer, please click "Comment".

Answer 3

My problem is, that I ask ONE user LastSignInDateTime 10 times - I receive two possible values randomly

~10-20% user are affected, not all users. Tried different tenants.
Using get-mguser or API.

I run this command 10 times and results are:

(get-mguser -UserId <userGUID> -Property SignInActivity).SignInActivity.LastSignInDateTime

17.11.2022 13:38
01.12.2022 10:02
17.11.2022 13:38
01.12.2022 10:02
17.11.2022 13:38
17.11.2022 13:38
01.12.2022 10:02
17.11.2022 13:38
17.11.2022 13:38
01.12.2022 10:02

Answer 4

I was experiencing the same issue but it appears to have disappeared with the account I was testing with.
I'll be opening a support ticket to get more information since we need this data to be reliable.

Answer 5

Not corrected yet... I still see ~3-4% users are affected.