How to get to know that the user is not logging into AVD from pat 30 days?

Question

How to get to know that the user is not logging into AVD from pat 30 days?

kavya madda 60

Hi,

I want to know the list of users who didn't logged (sign in activity) into AVD from past 20 or more than 20 days other than getting the idle state of AVD & AVD sessions.

what are the ways to find it out and what are the prerequisites for that?

what are the ways to achieve it and what level of accesses do I need?

Thanks in Advance

Accepted answer

0 additional answers

Your answer

Answer 1

Akshay kumar Mandha 3,390 Microsoft External Staff Moderator

Hi kavya madda,
Welcome to the Microsoft Q&A Platform. Thank you for posting your query here

Based upon your question, you can follow these steps to find out users who have not accessed Azure Virtual Desktop (AVD) in last 20 days using Azure Monitor and Log Analytics

Prerequisites: - Make sure you have contributor or monitoring Reader permissions on the log analytics workspace is enabled ensure AVD diagnostics are configured to send logs to your log analytics workspace first. Go to the azure monitor and then log analytics workspace. Please refer this document to configure Diagnostic Settings for Azure Virtual Desktop

You can review the logs to track user activity using Kusto Query Language (KQL). To find users who haven’t logged in for at least 20 days, use this query:

AVDActivityLogs
| where TimeGenerated < ago(20d)
| summarize LastSignIn=max(TimeGenerated) by UserPrincipalName
| where LastSignIn < ago(20d)

This query is used to filter the users with last sign-in activity as 20 days older. Review, and export the results as required.

If an answer has been helpful, please consider accepting the answer and "Upvote" to help increase visibility of this question for other members of the Microsoft Q&A community. User's image

Mark McCoy (Asperitas) 0 Reputation points

2024-09-09T19:00:08.5266667+00:00

So this does not answer the caller's question. They want to know who HAS NOT signed in.

It would be nice if this queried possible users from those who are eligible and then culled out all who had logged in within x days
Akshay kumar Mandha 3,390 Reputation points Microsoft External Staff Moderator

2024-09-10T10:32:46.42+00:00
Hi Mark McCoy (Asperitas),

Thanks for reaching out with your question. Based on your query, there’s a bit of a limitation here. If you have list of all your users, you can use this list to compare against recent sign-ins to find out who hasn’t logged in recently. However, without a predefined list of users, it’s challenging to identify those who have never logged in because the queries rely on the data that’s available in the logs.

If you do have a list of known users, you can use the following query to compare it with recent sign-in activity and identify those who haven't logged in within the past 20 days

let AllUsers = datatable(UserPrincipalName: string) [ "user1@example.com", "user2@example.com", // Add more users as needed ]; let RecentSignIns = WVDActivityLogs | where TimeGenerated >= ago(20d) | summarize LastSignIn=max(TimeGenerated) by UserPrincipalName; AllUsers | join kind=leftanti (RecentSignIns) on UserPrincipalName | project UserPrincipalName

Share via

How to get to know that the user is not logging into AVD from pat 30 days?

0 additional answers

Your answer