Sign-in logs

Gopi Ponnusamy 41

Hi Guys,

Any idea how to extract the user list based on sign-in logs who never log-in (in-active) past 30 days via Sentinal query or any other way?

Thanks in advance.!

1 answer

AmanpreetSingh-MSFT 56,646 Reputation points

2021-09-01T11:19:28.527+00:00
Hi @Gopi Ponnusamy • Thank you for reaching out.

You can use below Graph call to get a list of users who have not signed-in after a given date. In below example, you will get list of users who did not sign in after 2021-08-01.

GET https://graph.microsoft.com/beta/users?filter=signInActivity/lastSignInDateTime le 2021-08-01T00:00:00Z&$select=displayName

To test this call, you can Sign in to Graph Explorer using Global Administrator of your tenant and execute above GET call.

Permissions Required:

Directory.AccessAsUser.All

Directory.Read.All

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Gopi Ponnusamy 41 Reputation points

2021-09-01T15:26:34.307+00:00

Thanks for the response.
I was looking to export to excel/csv or like sentinal query.

AmanpreetSingh-MSFT 56,646 Reputation points

2021-09-02T12:48:59.1+00:00

Hi @Gopi Ponnusamy • As of now, the property lastSignInDateTime is accessible only via Graph API Beta endpoint. It cannot be fetched via Graph API V1 endpoint or Azure Sentinel or even via PowerShell (as mentioned in This Document).

At this point you will have to manually paste the output of the above Graph Call in MS Excel and do manual formatting to get the data in excel/csv, as mention below:

Use Text to Column option under Data tab > Delimit > Space > Next > Finish

Select first column and click on Filter option under Data tab > Click on the Drop Down arrow in the first column > Select DisplayName and ID checkboxes.

Copy the filtered data and paste in a new spreadsheet.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

AmanpreetSingh-MSFT 56,646 Reputation points

2021-09-06T05:58:02.17+00:00

@Gopi Ponnusamy • Just checking if you have any further question.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Sign-in logs

1 answer

Your answer