How do I get the last login timestamp from azure b2c?

Question

Hello.

I'm trying to figure out how I could implement automatic removal of users in azure ad b2c after a period of inactivity. I'm using an external identity provider (oidc) to make it possible for users to login. I have a userflow that redirects the user to the external identity provider and the user is then stored in B2C.

Is it possible to configure this in b2c? Or is it possible to use the graph api for this? I cannot get the graph api to return any information about sign ins. And I cannot se anything in the audit logs related to sign ins either.

Answer 1

Hi @Mårten Olofsson

Thank you for posting this in Microsoft Q&A.

I understand that you would like to implement the automatic removal of users in Azure AD B2C after a period of inactivity and are looking for a way to obtain the last login timestamp from Azure B2C.

Azure AD B2C emits audit logs that contain information about activities related to B2C resources, issued tokens, and administrator access rights. These audit logs are critical for understanding and managing user activity, authentication, and authorization processes in an Azure AD B2C environment.

The categories in the audit logs contain the following types of activities

Sign-in activities are also recorded in the audit log as part of authentication. When a user logs in to an Azure AD B2C-protected application using their credentials, the associated login activities (e.g., user authentication, token issuance, etc.) are captured and logged in the audit log. These log entries typically contain detailed information about the login activity, such as the name of the activity (e.g., “issue id_token to application”), the initiator (the object ID of the B2C application the user is logging into), the target (the object ID of the user who is logging in), and other pertinent information (e.g., the Tenant ID, Policy ID, and application ID).

I cannot get the graph api to return any information about sign ins. And I cannot se anything in the audit logs related to sign ins either.

Login activities not shown in the sign-in logs because it will record in the audit logs. You can access audit logs using the Azure AD B2C tenant or API.

Is it possible to configure this in b2c? Or is it possible to use the graph api for this?

By default, Azure AD B2C does not store the last login time of users. However, you can use custom policies to track user behavior in Azure AD B2C by utilizing Application Insights, where you can store user sign-in timestamps.For more information: https://learn.microsoft.com/en-us/azure/active-directory-b2c/analytics-with-application-insights?pivots=b2c-custom-policy

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.