Logon History For Single AD User

Chad Guiney 1 Reputation point
2020-04-30T12:16:19.96+00:00

I am looking for a Powershell script that can list the logon history for a specific user. I have searched all over and everything I am finding is getting a report for ALL AD users logon history. What I need is to specify by username all logon attempts within a specific time frame. Any help is GREATLY appreciated!!

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,422 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Saurabh Sharma 23,671 Reputation points Microsoft Employee
    2020-04-30T22:38:36.183+00:00

    You can use Get-AzureADAuditSignInLogs cmdlet to get the user sign-in activities. You need to add -Filter to the cmdlet to get logs of a specific user e.g.

    Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1'"

    You can also combine CreatedDateTime in -filter to filter events occurred based on time. e.g.

    Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1' and createdDateTime gt 2020-04-21T10:30:00.0Z"

    0 comments