Why Exchange Last Logon Time Differs from Azure AD Sign-In Activity
Question details
Users or administrators notice a discrepancy between the last logon time recorded in Exchange Online and the user's sign-in activity logged in the Azure AD portal.
- Product
- Exchange Online, Azure AD
- Device & OS
- not provided
- Scenario
- Monitoring account activity or auditing sign-in logs in a hybrid or cloud Microsoft 365 environment.
- Observed behavior
- The user's last logon time in Exchange Online does not match the authentication timestamp shown in Azure Active Directory sign-in activity.
Ensure you have administrative access to both the Microsoft 365 Exchange Admin Center and the Azure Active Directory portal to review account logs.
Investigate Shared Mailbox and Delegate Access
Determine if the log discrepancy is caused by another user or service accessing a shared resource.
Exchange last-logon data often represents access by another user or an Exchange service rather than the account owner. If a mailbox or calendar is shared, the Exchange log will update when the delegate accesses it, while Azure AD only logs when the primary user directly authenticates.
Check if the affected account is configured as a shared mailbox or has shared calendar permissions enabled in your organization.
Open the Exchange Admin Center, navigate to the specific mailbox settings, and check for delegated access rights such as Full Access, Send As, or Send on Behalf.
Open the Azure AD portal and review the user's sign-in activity logs. Rely on these logs to see when the specific user accurately authenticated to the service.
Boost Your Productivity with WPS Office
While managing your organization's backend Exchange and Azure AD environments, ensure your team has the best desktop client tools. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for creating, editing, and managing your daily documents.
Frequently Asked Questions
Why does Azure AD show no recent sign-in, but Exchange shows a login today?
This typically occurs when a background Exchange service, a third-party application with impersonation rights, or a mailbox delegate accesses the account. Exchange records the access event, but Azure AD accurately reflects that the account owner did not personally authenticate.
Can shared calendars update the Exchange last logon time?
Yes. If a colleague views or edits a calendar shared by the user, Exchange logs this activity, updating the last logon time for the mailbox owner even if they are offline.
Which log should I trust for auditing user authentication?
For security and authentication auditing, always rely on the Azure Active Directory sign-in activity logs. They specifically track when the user's actual credentials were used to authenticate.
