Account Security Problems

How to Generate a Microsoft 365 User Activity and Last Login Report

John Wilson Oct 22, 2026 868 views

Question details

Administrators need to retrieve user sign-in and activity information in Microsoft 365 to monitor service usage or verify last login times.

How to Generate a Microsoft 365 User Activity and Last Login Report

Product: Microsoft 365
Device & OS: not provided
Scenario: Generating administrative reports on user activity and sign-in history for organizational management.
Observed behavior: Administrators require a secure method to extract user activity logs and login timestamps while properly adhering to privacy regulations.

Before you start

Ensure you have the necessary administrator permissions in your Microsoft 365 tenant and that your organization's licensing supports advanced audit log access.

Solution 1Recommended

Use Microsoft Graph API for User Activity Reports

Utilize Microsoft Graph API endpoints to securely extract comprehensive sign-in and activity data for Microsoft 365 users.

Microsoft Graph provides a unified programmability model to access data in Microsoft 365, including user activity and last sign-in logs. The available data depends on your organization's retention policies, permissions, and licensing tier.

It is strictly advised to limit report access to authorized personnel only, document the administrative purpose, and comply with relevant privacy and employment laws. Avoid using activity reports for invasive employee monitoring.

Set up Microsoft Graph API access

Register your application in the Azure Active Directory admin center and grant the necessary API permissions (such as AuditLog.Read.All and Directory.Read.All) to allow access to sign-in reports.

Authenticate your application

Use Microsoft Graph authentication protocols to obtain a secure access token for your administrative session.

Query the sign-in endpoints

Make a GET request to the appropriate Microsoft Graph endpoint (e.g., /users/{id}/signInActivity or /auditLogs/signIns) to retrieve the last login data and activity logs.

Export and analyze the report

Extract the JSON response data to compile your user activity report. Focus on identifying service delivery issues or inactive accounts rather than tracking constant online presence.

Use Microsoft Graph API for User Activity Reports

Privacy and Performance Evaluation: Employee performance should generally be evaluated against defined goals and outcomes rather than measuring keystrokes or constant activity tracking.

Free Microsoft Office alternative

Manage Your Documents Effectively with WPS Office

While Microsoft 365 requires complex administrative tools for user management, WPS Office offers a lightweight, highly compatible, and user-friendly alternative for managing your daily document tasks without heavy administrative overhead.

1. Visit the WPS Office website: Go to the official WPS Office homepage to explore the features.
2. Download the installer: Click the free download button corresponding to your operating system.
3. Install and start working: Follow the simple installation wizard to set up your lightweight Office alternative in minutes.

Fully compatible with Microsoft Word, Excel, and PowerPoint file formats.Lightweight installation with a clean, intuitive interface familiar to all users.Completely free to use for individual users with robust basic document editing features.Focuses on efficient document creation without invasive user activity tracking.

microsoft office alternative - wps office

Frequently Asked Questions

Who has permission to view Microsoft 365 user activity reports?

Only authorized administrators with specific role assignments, such as Global Reader, Reports Reader, or Global Administrator, can access user activity and sign-in reports in the Microsoft 365 admin center or via the Graph API.

Can I track exact employee keystrokes using Microsoft 365 activity reports?

No, Microsoft 365 activity reports do not track keystrokes or exact screen activity. They log service events, document access, and sign-in timestamps. Monitoring performance through constant online presence tracking is considered invasive and is strongly discouraged.

How long is Microsoft 365 sign-in data retained?

The retention period for audit logs and sign-in data depends on your Microsoft 365 subscription tier and licensing. Typically, Azure AD Premium P1 or P2 licenses retain sign-in data for 30 days, while free tiers may have shorter retention periods.

Microsoft Office Security Issues