Logon History For Single AD User

Chad Guiney 1 Reputation point

I am looking for a Powershell script that can list the logon history for a specific user. I have searched all over and everything I am finding is getting a report for ALL AD users logon history. What I need is to specify by username all logon attempts within a specific time frame. Any help is GREATLY appreciated!!

Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
12,707 questions
No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Saurabh Sharma 17,291 Reputation points Microsoft Employee

    You can use Get-AzureADAuditSignInLogs cmdlet to get the user sign-in activities. You need to add -Filter to the cmdlet to get logs of a specific user e.g.

    Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1'"

    You can also combine CreatedDateTime in -filter to filter events occurred based on time. e.g.

    Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1' and createdDateTime gt 2020-04-21T10:30:00.0Z"

    No comments