How to Check a User's Most Recent Microsoft 365 Mailbox Sign-In
Question details
Administrators need to find and verify the last time a user accessed their Microsoft 365 Outlook mailbox.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Verifying mailbox access activity, specifically checking for access after a user has been offboarded or blocked.
- Observed behavior
- Timestamps might show recent activity even after a user is blocked, prompting a need to differentiate between interactive user sign-ins and background service processing.
Ensure you have the necessary administrator roles (such as Global Administrator, Exchange Administrator, or Security Reader) in Microsoft 365 and Microsoft Entra ID to access audit and sign-in logs.
Review Microsoft Entra ID Sign-In Logs
Use Microsoft Entra ID (formerly Azure AD) to check explicit, interactive user sign-ins to Microsoft 365 services.
Microsoft Entra ID sign-in logs provide a comprehensive view of authentication events. By filtering these logs, administrators can distinguish between actual user activity (interactive) and background application authentications (non-interactive).
Log in to the Microsoft Entra admin center using your administrator credentials.
Go to 'Identity' > 'Users' > 'All users' and search for the specific user's name or email address.
Select the user, then click on 'Sign-in logs' from the left-hand navigation menu under the Activity section.
Add a filter for 'Application' and set it to 'Office 365 Exchange Online' to isolate mailbox authentication attempts.
Check Exchange Mailbox Access via PowerShell
Use Exchange Online PowerShell to retrieve the last logon time directly from the mailbox statistics.
Search Microsoft 365 Audit Logs
Use the unified audit log in the Microsoft Purview compliance portal for detailed mailbox activities.
Manage Your Documents Efficiently with WPS Office
While managing Microsoft 365 mailboxes requires administrative backend tools, you can handle your daily document, spreadsheet, and presentation needs with WPS Office—a lightweight, free alternative that is highly compatible with Microsoft formats and requires no complicated licensing.
- 1. Download the installer: Visit the official WPS website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen instructions to complete the setup in minutes.
- 3. Open your Microsoft Office files: Launch WPS Office and directly open your existing .docx, .xlsx, or .pptx files with full formatting support.
Frequently Asked Questions
Why does a blocked or offboarded user still show a recent mailbox login time today?
Background processes, delegated mailbox access, Exchange mailbox processing tasks, or automated token renewals can trigger activity that updates the last logon timestamp in mailbox statistics, even when interactive sign-in is completely blocked for the user.
Can I filter Microsoft Entra ID sign-in logs to show only mailbox sign-ins?
Yes, you can filter the Microsoft Entra ID sign-in logs by setting the Application filter to 'Office 365 Exchange Online'. This allows you to view authentication events specifically targeting the user's mailbox.
What is the difference between interactive and non-interactive sign-ins?
Interactive sign-ins require the user to actively provide credentials or pass multifactor authentication (MFA). Non-interactive sign-ins are performed automatically by background client apps or services using existing, valid authentication tokens without user prompts.
How long are Microsoft 365 Audit Logs retained?
By default, Microsoft 365 audit logs are retained for 180 days for users with standard licenses. Users with an E5 license or equivalent may have audit logs retained for up to one year, which is crucial for investigating older offboarded user activity.
