How can I get information on Entra users last logon?

Question

How can I get information on Entra users last logon to the system in order to look for older user accounts that should be reviewed?

• I want to reduce dormant user accounts
• reduce active users and re-issue licenses
• back up users data before fully removing them from the Entra

Answer 1

Hello Cameron Summers,

You can use the Sign-in Activity information in Microsoft Entra ID to identify inactive accounts.

In the Microsoft Entra admin center, go to Users > All users, add the Last interactive sign-in and Last non-interactive sign-in columns, and then sort or filter by date to find accounts that have not been used recently.

You can also retrieve this information using Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"
Get-MgUser -All -Property DisplayName,UserPrincipalName,SignInActivity |
Select-Object DisplayName,UserPrincipalName,
@{Name="LastSignIn";Expression={$_.SignInActivity.LastSignInDateTime}}

Before removing any accounts, it is a good practice to verify they are no longer required, back up any necessary data, and remove or reassign licenses as needed. Service accounts should be reviewed separately, as they may not have regular user sign-in activity.