Graph API Users signInActivity returns RequestId of Failed Logins

Tony Morrow 0 Reputation points

I wonder if anyone has insights into this issue. I've using the Graph API to return a user's information including signInActivity. I've noticed that for some users, the lastSignInDateTime and lastSignInRequestId will be for a failed sign in log. I can see this the most for users whose accounts are actively being spammed with login attempts by malicous actors and Microsoft is started blocking the authentications. Any ideas of how I can get accurate signInActivity for my users? The signIns API is soooooo slow, so I'd like to avoid searching it if possible.

Here is an example of the API response

User's image

And here is what the sign-in request looks like.

User's image

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
9,174 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Vasil Michev 85,646 Reputation points MVP

    Yes, that's the expected behavior currently - both failed and successful attempts are returned. Microsoft is looking into providing a "success" timestamp in a future updated, no ETA yet though.