Script to extract last Logon Time of Every user

Question

Dear All

I've been searching around the Web to find a script of the lastlogontime of all AzureAD Users and found this script:

Install-Module AzureADPreview
Import-Module AzureADPreview
$Cred = Get-Credential
Connect-MsolService -Credential $Cred
Connect-AzureAD -Credential $Cred

$Users = Get-MsolUser -all
$Headers = "DisplayName`tUserPrincipalName`tLicense`tLastLogon" >>C:\list.csv
ForEach ($User in $Users)
    {
    $UPN = $User.UserPrincipalName
    $LoginTime = Get-AzureAdAuditSigninLogs -top 1 -filter "userprincipalname eq '$UPN'" | select CreatedDateTime
    $NewLine = $User.DisplayName + "`t" + $User.UserPrincipalName + "`t" + $User.Licenses.AccountSkuId + "`t" + $LoginTime.CreatedDateTime
    $NewLine >>'C:\list.csv'
    }

It seems that it doesn't recognize the input "Get-AzureAdAuditSigninLogs , even though the required module is installed and loaded "this cmdlet is not recognized".

Is there any other module I need to install or import?

Thank you for your help.

Kind regards,

Gabe

Answer 1

Hello Gabe,

it looks like you have both modules AzureAD and AzureADPreview installed.

To make sure that you connect with the Connect-AzureAD cmdlet of module AzureADPreview you have to execute the cmdlet like this:
AzureADPreview\Connect-AzureAD

I also did a quick review of the script you posted and wrote one where you don't have to use the MSOnline cmdlets:

Import-Module AzureADPreview

AzureADPreview\Connect-AzureAD

$user = Get-AzureADUser -All $true
$report = @()

$displayName = @{n='DisplayName';e={$PSItem.UserDisplayName}}
$lastLogon = @{n='LastLogon';e={Get-Date -Date $PSItem.CreatedDateTime -Format G}}

foreach ($u in $user)
{
    $upn = $u.UserPrincipalName
    $report += Get-AzureAdAuditSigninLogs -Filter "userprincipalname eq '$upn'" -Top 1 | Select-Object -Property $displayName,UserPrincipalName,$lastLogon
}

$report | Export-Csv -Path ("{0}\Desktop\aad_lastlogon.csv" -f $env:USERPROFILE) -NoTypeInformation -Delimiter ';' -Encoding UTF8

Answer 2

I hope this helps you completing your task.

Br
Stephan

Answer 3

Dear Stephan

Thank you very much! I am now able to use the Cmdlet, but I unfortuanetly still get this error message:

Get-AzureAdAuditSigninLogs : Error occurred while executing GetAuditSignInLogs 
Code: UnknownError
Message: Too Many Requests
InnerError:
  RequestId: e0f3c65e-c3d4-48ee-ae5d-b5ff00475c97
  DateTimeStamp: Mon, 28 Sep 2020 08:16:53 GMT
HttpStatusCode: 429
HttpStatusDescription: 
HttpResponseStatus: Completed
At C:\Ex_Powershell\Office365_Userlist.ps1:14 char:16
+ ...  $report += Get-AzureAdAuditSigninLogs -Filter "userprincipalname eq  ...

Is there a way to use less requests?...because I could lower the amount of requests (f.e. only logins that have been done before the 28th of June).

Kind regards,

Gabriel

Edit: Okay, i already tried to lower the amounts of requests by adding "and CreateDateTime" but it still shows the same errormessage...

Answer 4

Hello Gabriel,

the parameter -Top with value 1 should already return only the newest sign-in event:
https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureadauditsigninlogs?view=azureadps-2.0-preview#parameters

Which version of AzureADPreview are you using? Please check with "Get-Module -Name AzureAdPreview". I currently have version 2.0.2.117 installed and I'm receiving no errors like the one above.

Br,
Stephan