Script to extract last Logon Time of Every user RRS feed

  • Question

  • Dear All

    I've been searching around the Web to find a script of the lastlogontime of all AzureAD Users and found this script:

    Install-Module AzureADPreview

    Import-Module AzureADPreview $Cred = Get-Credential Connect-MsolService -Credential $Cred Connect-AzureAD -Credential $Cred $Users = Get-MsolUser -all $Headers = "DisplayName`tUserPrincipalName`tLicense`tLastLogon" >>C:\list.csv ForEach ($User in $Users) { $UPN = $User.UserPrincipalName $LoginTime = Get-AzureAdAuditSigninLogs -top 1 -filter "userprincipalname eq '$UPN'" | select CreatedDateTime $NewLine = $User.DisplayName + "`t" + $User.UserPrincipalName + "`t" + $User.Licenses.AccountSkuId + "`t" + $LoginTime.CreatedDateTime $NewLine >>'C:\list.csv' }

    It seems that it doesn't recognize the input "Get-AzureAdAuditSigninLogs , even though the required module is installed and loaded "this cmdlet is not recognized".

    Is there any other module I need to install or import?

    Thank you for your help.

    Kind regards,


    Thursday, September 24, 2020 7:35 AM

All replies

  • Hello Gabe,

    it looks like you have both modules AzureAD and AzureADPreview installed.

    To make sure that you connect with the Connect-AzureAD cmdlet of module AzureADPreview you have to execute the cmdlet like this:

    I also did a quick review of the script you posted and wrote one where you don't have to use the MSOnline cmdlets:

    Import-Module AzureADPreview
    $user = Get-AzureADUser -All $true
    $report = @()
    $displayName = @{n='DisplayName';e={$PSItem.UserDisplayName}}
    $lastLogon = @{n='LastLogon';e={Get-Date -Date $PSItem.CreatedDateTime -Format G}}
    foreach ($u in $user)
        $upn = $u.UserPrincipalName
        $report += Get-AzureAdAuditSigninLogs -Filter "userprincipalname eq '$upn'" -Top 1 | Select-Object -Property $displayName,UserPrincipalName,$lastLogon } $report | Export-Csv -Path ("{0}\Desktop\aad_lastlogon.csv" -f $env:USERPROFILE) -NoTypeInformation -Delimiter ';' -Encoding UTF8

    Sunday, September 27, 2020 8:10 AM
  • I hope this helps you completing your task.


    Sunday, September 27, 2020 8:13 AM
  • Dear Stephan

    Thank you very much! I am now able to use the Cmdlet, but I unfortuanetly still get this error message:

    Get-AzureAdAuditSigninLogs : Error occurred while executing GetAuditSignInLogs 
    Code: UnknownError
    Message: Too Many Requests
      RequestId: e0f3c65e-c3d4-48ee-ae5d-b5ff00475c97
      DateTimeStamp: Mon, 28 Sep 2020 08:16:53 GMT
    HttpStatusCode: 429
    HttpResponseStatus: Completed
    At C:\Ex_Powershell\Office365_Userlist.ps1:14 char:16
    + ...  $report += Get-AzureAdAuditSigninLogs -Filter "userprincipalname eq  ...

    Is there a way to use less requests?...because I could lower the amount of requests (f.e. only logins that have been done before the 28th of June).

    Kind regards,


    Edit: Okay, i already tried to lower the amounts of requests by adding "and CreateDateTime" but it still shows the same errormessage...

    Monday, September 28, 2020 8:19 AM
  • Hello Gabriel,

    the parameter -Top with value 1 should already return only the newest sign-in event:

    Which version of AzureADPreview are you using? Please check with "Get-Module -Name AzureAdPreview". I currently have version installed and I'm receiving no errors like the one above.


    Monday, October 19, 2020 8:57 PM