Azure Graph the last successful login has not been updated immediately and it is taking more than 24 hrs to get it updated in the logs.

Question

We have a script to alert users when their adm account is set to disable. The user has reset his password and logged into MyJITA portal using his adm id, but the lastSuccessfulLogin has not updated.

 

The user logged out and logged back into the MyJITA portal sometime back. But still in Azure Graph the last successful login has not been updated.

We have automations on our end that makes use of last logged in time stamp in Entra ID. The user logged out and logged back into the MyJITA portal sometime back. But still in Azure Graph the last successful login has not been updated immediately.

• If we can get some confirmation on the issue that it has been fixed, then we will proceed with enabling jobs on our end.
• For accounts with stale logged in timestamp -> We do not have a way to identify these accounts. However, if there is anything you can suggest that will help address these stale accounts, pls let us know.

wanted to check why we are seeing delay in updating the lastlogin timestamp?

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.authentication/connect-mggraph?view=graph-powershell-1.0

 

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/get-mguser?view=graph-powershell-1.0

Connect-MgGraph (Microsoft.Graph.Authentication)

we use these commands internally it may call API

 

Answer 1

Hello,

Welcome to Microsoft Q&A,

This is expected behavior due to how Azure AD / Entra ID logs and syncs sign-in activity:

1. Sign-in logs aren't real-time in Microsoft Graph.
2. The lastSignInDateTime or lastSuccessfulSignIn property (available under /beta and /v1.0) is eventually consistent and may take up to 24–72 hours to reflect.

https://learn.microsoft.com/en-us/graph/api/resources/signinactivity?view=graph-rest-1.0#properties

Use Azure Sign-in Logs (via Graph /auditLogs/signIns)

Instead of relying on the cached property (lastSignInDateTime), query the actual sign-in logs:

Connect-MgGraph -Scopes "AuditLog.Read.All"  

Get-MgAuditLogSignIn -Filter "userPrincipalName eq '******@domain.com'" -Top 1

• This provides most recent sign-in events and status (success/failure).
• It is closer to real-time (~5-15 minute delay).

Please upvote and accept the answer if it helps!!