Logon History For Single AD User

Chad Guiney 1 Reputation point

I am looking for a Powershell script that can list the logon history for a specific user. I have searched all over and everything I am finding is getting a report for ALL AD users logon history. What I need is to specify by username all logon attempts within a specific time frame. Any help is GREATLY appreciated!!

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,590 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Saurabh Sharma 23,791 Reputation points Microsoft Employee

    You can use Get-AzureADAuditSignInLogs cmdlet to get the user sign-in activities. You need to add -Filter to the cmdlet to get logs of a specific user e.g.

    Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1'"

    You can also combine CreatedDateTime in -filter to filter events occurred based on time. e.g.

    Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1' and createdDateTime gt 2020-04-21T10:30:00.0Z"

    0 comments No comments