How to View Microsoft 365 Users' Last Sign-In Times
Question details
Administrators need to check the last sign-in times and activity logs for Microsoft 365 users to monitor account security.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Monitoring user activity, auditing account access, and reviewing multifactor authentication details.
- Observed behavior
- Administrators want to access detailed logs including dates, users, applications, sign-in status, and risk information.
Ensure you have the appropriate administrator permissions (such as Global Administrator or Security Reader) and the required Microsoft Entra ID licensing to access and retain detailed sign-in logs.
View Sign-in Logs via Microsoft Entra Admin Center
Use the Microsoft Entra admin center to filter and monitor detailed sign-in activities for your Microsoft 365 tenant.
Microsoft 365 logs are managed through Microsoft Entra ID (formerly Azure Active Directory). By accessing the admin center, you can view comprehensive records of user access, including application used, IP address, and MFA status.
Open your web browser, navigate to the Microsoft Entra admin center, and log in with your administrator credentials.
On the left navigation pane, expand 'Identity' or 'Azure Active Directory', open 'Monitoring & health', and select 'Sign-in logs'.
Use the filter bar at the top of the logs page to sort by specific user, date range, application, or sign-in status to pinpoint the exact last sign-in time.
Click the 'Columns' button to add or remove specific details, such as risk information or multifactor authentication requirements, to better suit your audit needs.
Looking for a Secure, Cost-Effective Office Suite?
While Microsoft 365 requires complex administrative management and recurring subscription fees, WPS Office offers a free, lightweight, and highly compatible alternative. Enjoy seamless document creation and editing without the overhead of heavy tenant management.
- 1. Download the Installer: Visit the official WPS Office website to download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen instructions for a quick, lightweight setup.
- 3. Open Microsoft Formats: Launch WPS Office and instantly open your existing Word, Excel, and PowerPoint files without formatting loss.
Frequently Asked Questions
Why can't I see sign-in logs older than 30 days?
By default, Microsoft Entra ID Premium P1 and P2 licenses retain sign-in data for up to 30 days. Free or Basic licenses have a shorter retention period, typically limited to 7 days.
Can I export Microsoft 365 sign-in logs for compliance purposes?
Yes, you can export the logs to a CSV file directly from the portal, or route them to Azure Monitor (Log Analytics workspace, Storage Account, or Event Hub) for long-term retention.
Do I need special permissions to view user sign-in times?
Yes. You must be assigned a role such as Global Reader, Security Reader, Security Administrator, Report Reader, or Global Administrator to access the sign-in logs in Microsoft Entra.
Can I check the last sign-in time using PowerShell?
Yes, administrators can use the Microsoft Graph PowerShell module, specifically using the Get-MgAuditLogSignIn cmdlet, to retrieve user sign-in activity programmatically.
