question

ChadGuiney-4962 avatar image
0 Votes"
ChadGuiney-4962 asked ·

Logon History For Single AD User

I am looking for a Powershell script that can list the logon history for a specific user. I have searched all over and everything I am finding is getting a report for ALL AD users logon history. What I need is to specify by username all logon attempts within a specific time frame. Any help is GREATLY appreciated!!

azure-active-directory
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

SaurabhSharma-msft avatar image
0 Votes"
SaurabhSharma-msft answered ·

You can use Get-AzureADAuditSignInLogs cmdlet to get the user sign-in activities. You need to add -Filter to the cmdlet to get logs of a specific user e.g.

Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1'"

You can also combine CreatedDateTime in -filter to filter events occurred based on time. e.g.

Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1' and createdDateTime gt 2020-04-21T10:30:00.0Z"

·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.