Export Microsoft 365 users last sign-in date and time

You can get the user’s last successful sign-in activity date time in the Microsoft Entra admin center and Microsoft 365 admin center. The disadvantage is that it will show the user’s sign-in activity for the last 7 days. In this article, you will learn how to export Microsoft 365 users last sign-in date and time with Microsoft Graph PowerShell.

Microsoft 365 user last sign-in activity date

When a user signs into a Microsoft product, it will save this information to their sign-in activity. If you have the Microsoft Entra ID Free license, you can only check the last sign-in activity for the past 7 days for a Microsoft 365 user.

Last sign-in activity date vs. Last successful sign-in activity date:

• Last sign-in activity: It shows the last time a user signs in with their username and password (success or failure).
• Last non-interactive sign-in activity: It shows the last time a user signs in without using their username and password (success or failure).
• Last successful sign-in activity: The last time a user signs with their username and password and succeeds.

The table below shows the different methods available with a Microsoft Entra ID license Free.

Microsoft portals	User data	Microsoft Entra ID license	Download CSV	Last sign-in activity	Last non-interactive sign-in activity	Last successful sign-in activity
Microsoft 365 admin center	Single	Free	Not available	Last 7 days	Not available	Last 7 days
Microsoft Entra admin center	Single and multiple users	Free	Available	Last 7 days	Last 7 days	Last 7 days
Microsoft Graph PowerShell	Not available	Free	Not available	Not available	Not available	Not available

The table below shows the different methods available for a Microsoft Entra ID P1/P2 license.

Microsoft portals	User data	Microsoft Entra ID license	Download CSV	Last sign-in activity	Last non-interactive sign-in activity	Last successful sign-in activity
Microsoft 365 admin center	Single	P1/P2	Not available	Last 30 days	Not available	Last 30 days
Microsoft Entra admin center	Single and multiple users	P1/P2	Available	Last 30 days	Last 30 days	Last 30 days
Microsoft Graph PowerShell	Single and multiple users	P1/P2	Available	From April, 2020	From May, 2020	From December 1, 2023*

*The data will start recording sign-ins after December 1, 2023, because the property is new.

We will show you how to export a single and all Microsoft 365 users last sign-in date and time in:

• Microsoft Entra admin center
• Microsoft Graph PowerShell

Get Microsoft 365 users sign-in activity in Microsoft Entra ID

Microsoft Entra admin center saves the last sign-in logs of all the Microsoft 365 users for the past 30 days. We will show you how to check and export the last sign-in activity for a single and all Microsoft 365 users.

Microsoft Entra ID shows these types of sign-ins for the users:

• Interactive sign-ins: Sign-ins are done by the user who signs in with their username and password or MFA, such as the Microsoft Authenticator app.
• Non-interactive sign-ins: Sign-ins done on behalf of a user, such as a client app that doesn’t require MFA authentication from the user. For example, if the user signed in before, it will save the login for next time, so they don’t need to provide their username and password or MFA.

Get single Microsoft 365 user sign-in logs

To get a single Microsoft 365 user sign-in activity in Microsoft Entra ID, follow these steps:

1. Sign in to Microsoft Entra admin center
2. Expand Identity > Users > All users
3. Click on a specific user

4. Click Sign-in logs
5. Click the tab User sign-ins (interactive)

The list of all the interactive sign-ins with the date and time of the last 24 hours appears by default. If you can’t find any sign-in logs, you should change the date to the last 1 month and click apply.

6. Click the tab User sign-ins (non-interactive)

The list of all the non-interactive sign-ins with the date and time of the last 24 hours appears by default. If you can’t find any sign-in logs, you should change the date to the last 1 month and click apply.

Get all Microsoft 365 users sign-in logs

To export all Microsoft 365 users sign-in activity in Microsoft Entra ID, follow these steps:

1. Sign in to Microsoft Entra admin center
2. Expand Identity > Users > All users
3. Click Sign-in logs
4. Click the tab User sign-ins (interactive)

A list of all the users’ sign-ins with the date and time of the last 7 days appears by default. You can always change the date, but it can only show you the sign-ins for the last month.

5. Click the tab User sign-ins (non-interactive)

A list of all the users non-interactive sign-ins with the date and time of the last 7 days appears by default. You can always change the date, but it can only show you the sign-ins for the last month.

To export the sign-in activity of Microsoft 365 users longer than 1 month, you must use PowerShell in the next step.

Connect to Microsoft Graph PowerShell

Before you start, you must Install Microsoft Graph PowerShell module, including the Microsoft Graph Beta module.

Run the below command to install the Microsoft Graph modules.

Install-Module Microsoft.Graph -Force
Install-Module Microsoft.Graph.Beta -AllowClobber -Force

Then you need to Connect to Microsoft Graph PowerShell with the below scopes.

Connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All"

You are set to use the cmdlets with Microsoft Graph PowerShell in the next steps.

Export Microsoft 365 users last sign-in activity report with PowerShell

We will show you the steps to export Microsoft 365 users last sign-in activity report to a CSV file with PowerShell.

It will gather the following information per user:

1. Id
2. UserPrincipalName
3. DisplayName
4. UserType
5. Mail
6. AccountEnabled
7. LastSuccessfulSignInDate
8. LastNonInteractiveSignInDateTime
9. LastSignInDateTime
10. DaysSinceLastSuccessfulSignIn

Create the temp folder in your (C:) drive if you don’t have them already.

Get Microsoft 365 user last sign-in activity with PowerShell

When looking at the users last sign-in activity date and time, you will find these properties in PowerShell:

• LastNonInteractiveSignInDateTime: The last non-interactive sign-in (success or failure) date and time for a specific user. In PowerShell it shows the Microsoft Entra ID non-interactive sign-ins from May 2020.
• LastSignInDateTime: The last interactive sign-in (success or failure) date and time a user attempted. In PowerShell it shows the Microsoft Entra ID interactive sign-ins from April 2020.
• LastSuccessfulSignInDateTime: The last successful interactive date and time a user signs in with a password. In PowerShell it shows the last successful sign-in date from December 2023.

Get single Microsoft 365 user last sign-in activity date time

To get a single user last sign-in activity, you need to use their Object ID.

Run the below PowerShell command to get the last sign-in activity of a single user.

Get-MgBetaUser -UserId "944d57a0-0d24-4d55-ac5b-e9b741be9031" -Property SignInActivity | Select-Object -ExpandProperty SignInActivity | fl

If you don’t have the user Object ID, you can use the UserPrincipalName with the below PowerShell command.

Get-MgBetaUser -Filter "UserPrincipalName eq 'Anna.Bell@m365info.com'" -Property SignInActivity | Select-Object -ExpandProperty SignInActivity | fl

The PowerShell output shows the last sign-in date time and the last successful sign-in date time for a single user.

LastNonInteractiveSignInDateTime  : 05/02/2024 18.03.59
LastNonInteractiveSignInRequestId : 7b9071c3-0964-4574-b046-b5cd84b3c500
LastSignInDateTime                : 31/01/2024 09.04.00
LastSignInRequestId               : 7a1e3990-5e1f-4532-9f50-da26de3b0c01
LastSuccessfulSignInDateTime      : 05/02/2024 18.03.59
LastSuccessfulSignInRequestId     : 7b9071c3-0964-4574-b046-b5cd84b3c500
AdditionalProperties              : {}

Export all Microsoft 365 users sign-in activity report CSV file

Get all the users (including members and guests) last successful sign-in activity report and export it to an Out-Gridview and CSV file.

Run the below PowerShell script to export a full report of all the users last sign-in date and time.

$Users = Get-MgBetaUser -All -Property Id, UserPrincipalName, DisplayName, UserType, SignInActivity, Mail, AccountEnabled | 
Select-Object Id, UserPrincipalName, DisplayName, UserType, Mail, AccountEnabled,
@{n = "LastSuccessfulSignInDateTime"; e = { $_.SignInActivity.LastSuccessfulSignInDateTime } },
@{n = 'LastNonInteractiveSignInDateTime'; e = { $_.SignInActivity.LastNonInteractiveSignInDateTime } },
@{n = 'LastSignInDateTime'; e = { $_.SignInActivity.LastSignInDateTime } },
@{n = 'DaysSinceLastSuccessfulSignIn'; e = { (New-TimeSpan -Start $_.SignInActivity.LastSuccessfulSignInDateTime -End (Get-Date)).Days } }


$Users | Out-GridView -Title "Last sign-in activity report"
$Users | Export-Csv -Path "C:\temp\LastSignInActivity.csv" -NoTypeInformation -Encoding utf8

The Out-GridView appears, where you can search and filter the properties.

Open the CSV file with an application like Microsoft Excel to see the same results.

Did it help you to get the last login time of all Microsoft 365 users to a CSV file?

Read more: Bulk create Microsoft 365 users with CSV file »

Conclusion

You learned how to export Microsoft 365 users last sign-in date and time. This can be done in Microsoft Entra admin center or PowerShell. The Microsoft Entra admin center shows the users last interactive and non-interactive sign-in logs for the last 30 days. A better method is to use Microsoft Graph PowerShell to export a report of all the users sign-in activity because it will show results for more than 30 days.

Remember that you have limitations with a Microsoft Entra ID Free license, and you need a Microsoft Entra ID P1/P2 license to get the maximum out of it.

Did you enjoy this article? You may also like Bulk import contacts to Microsoft 365 using PowerShell. Don’t forget to follow us and share this article.