How to view Microsoft 365 login attempts using PowerShell and Microsoft Entra ID

Administrators often need to track their users' login history to monitor and detect suspicious activities. They can audit the login attempts of Microsoft 365 users with PowerShell and Microsoft Entra ID to identify abnormal behaviors, such as unusual login times or repeated login failures. This can help them identify potential security threats such as insider threats or brute force attempts. They can also audit login attempts to identify inactive or stale accounts, which can help them manage their licenses in a more efficient way.

Get your Microsoft 365 user login history using PowerShell

You can use the cmdlet mentioned below to generate a list of your Microsoft 365 users' login attempts. Before you run the cmdlet, you will have to replace the parameters with the following:

• $startDate with the earliest date from which you wish to generate the audit data.
• $endDate with the latest date up to which you wish to generate the audit data.

Search-UnifiedAuditLog -RecordType 'AzureActiveDirectoryStsLogon' -Operations 
'UserLoggedIn','UserLoginFailed' -StartDate $startDate -EndDate $endDate

View Microsoft 365 login attempts using Microsoft Entra ID and M365 Manager Plus

If you're looking for a more intuitive way to access these details, Microsoft Entra ID can help track login attempts in your Microsoft 365 environment with audit logs. This can be filtered for specific users, groups, or other attributes. ManageEngine M365 Manager Plus, a comprehensive tool used for reporting, managing, monitoring, auditing, and creating alerts for critical activities in your Microsoft 365 environments, can also be used to monitor the login activity of Microsoft 365 users.

Note: To view the most recent login activity of your Microsoft 365 users, check out this page on How to get the last logon date of Microsoft Entra ID users.

Limitations of using native tools to view Microsoft 365 user login history:

• Reports will have to be filtered every time they are generated, and the filters cannot be saved, which can get exhausting if a filter is required to generate data that you require frequently.
• Reports generated using Microsoft Entra ID can only be exported in CSV and JSON formats.
• Administrators must be assigned at least the Reports Reader role to access the reports displayed in Microsoft Entra ID.
• Assigning granular permissions to execute individual tasks in a broad category is not possible.

Benefits of using M365 Manager Plus to view the last logon date of users in Microsoft Entra ID

• Filter your reports just once and save them as custom reports that you can access in just a few clicks.
• Export the generated reports to CSV, PDF, XLSX, and HTML formats.
• Delegate granular permissions to technicians without elevating their Microsoft 365 privileges, and create custom roles with any combination of reporting, management, auditing, and monitoring tasks.
• Gain a thorough understanding of your environment not only in Microsoft Entra ID, but also other Microsoft 365 services such as Exchange Online, SharePoint Online, and OneDrive for Business with detailed reports from a single console.
• Create and customize alert profiles that can email you alerts for suspicious logons and other crucial events in your Microsoft 365 environment.