Microsoft 365：查找用户的上次登录日期

要求：查找 Microsoft 365 租户中所有用户的上次登录日期和时间戳。

PowerShell 在 Office 365 中生成上次登录日期报告

有效管理用户帐户对于使用 Office 365 的组织至关重要。用户管理的重要方面之一是监控用户活动，包括他们的上次登录日期。在这篇博文中，我们将指导您完成使用 PowerShell 查找 Office 365 中用户的上次登录日期的过程。

Microsoft 365 管理中心、Azure AD 登录日志和 PowerShell cmdlet Get-AzureADAuditSignInLogs - 所有三者在 Office 365 中的日志保存期限均为 30 天！

如果您想搜索过去 30 天内所有使用 PowerShell 的用户的最后登录日期，以下是适合您的脚本：

#Config Parameters
$CSVPath = "C:\Temp\SigninLogs.csv"
$SigninLogs = @()

#Connect to Azure AD
Connect-AzureAD | Out-Null

#Get All users from Azure AD
$AllUsers = Get-AzureADUser -All $true
$TotalUsers = $AllUsers.Count

#Function to get the last login time stamp of the user
Function Get-UserLastLogin([string] $UserObjectID)
{
    Try {
        Write-host -f Yellow "Collecting Last Login date of the User Object:"$UserObjectID

        #Get the Successful Signin Logs of the user
        $SigninLog = Get-AzureADAuditSignInLogs -All:$true -Filter "userID eq '$UserObjectID' and status/errorCode eq 0" | Select -First 1

        #Return Last Login Date
        $LoginDetails = New-Object psobject -Property @{
            LoginTime = $SigninLog.CreatedDateTime
            App = $SigninLog.AppDisplayName
        }
        Return $LoginDetails
    }
    Catch {
        $message = $_
        If ($message -like "*Too Many Requests*")
        {
            Write-host "`tSleeping for 10 seconds due to throttling limitations..." -ForegroundColor Cyan
            Sleep 10
            #Recursive function call to retry the entry that was throttled
            Get-UserLastLogin $UserObjectID
        }
        Else
        {
            Write-host $Message -ForegroundColor Red           
        }
    }
}

#Loop through all users
$Counter = 1
$AllUsers | ForEach-Object {
    Write-Progress -Activity "Checking Signin Logs:" -Status "Processing $($_.UserPrincipalName) ($Counter of $TotalUsers)" -PercentComplete (($Counter / $TotalUsers) * 100) 
    #Call the function to get the sign-in log
    $SignInLog = Get-UserLastLogin $_.ObjectID
    
    #Get the Last Login Date
    If ($SignInLog.LoginTime -eq $Null)
    {
        $LastLoginDate = "No Log-in Events Found!"
    }
    Else
    {
        $LastLoginDate = Get-Date $SignInLog.LoginTime
    }

    #Collect data
    $SigninLogs += [PSCustomObject][ordered]@{
        UserLoginName   = $_.UserPrincipalName
        UserDisplayName   = $_.DisplayName
        LastLogin  = $LastLoginDate
        Application = $SignInLog.App
    }
    $Counter++
}

$SigninLogs
#Export Data to CSV
$SigninLogs | Export-Csv -Path $CSVPath -NoTypeInformation

然而，上面的脚本只能获取30天的数据。

使用 Graph API PowerShell 生成 Office 365 的上次登录报告

Microsoft Graph API 可以获取最后登录日期，没有 30 天的限制！

先决条件

在访问Office 365用户的上次登录信息之前，您需要安装Microsoft Graph PowerShell模块。请参阅此处如何安装 Microsoft Graph PowerShell 模块？

#Connect to Microsoft Graph
Connect-MgGraph -Scopes "AuditLog.Read.All","User.Read.All"

#Set the Graph Profile
Select-MgProfile beta

#Properties to Retrieve
$Properties = @(
    'Id','DisplayName','Mail','UserPrincipalName','UserType', 'AccountEnabled', 'SignInActivity'    
)

#Get All users along with the properties
$AllUsers = Get-MgUser -All -Property $Properties #| Select-Object $Properties

$SigninLogs = @()
ForEach ($User in $AllUsers)
{
    $SigninLogs += [PSCustomObject][ordered]@{
            LoginName       = $User.UserPrincipalName
            Email           = $User.Mail
            DisplayName     = $User.DisplayName
            UserType        = $User.UserType
            AccountEnabled  = $User.AccountEnabled
            LastSignIn      = $User.SignInActivity.LastSignInDateTime
    }
}

$SigninLogs

#Export Data to CSV
$SigninLogs | Export-Csv -Path "C:\Temp\SigninLogs.csv" -NoTypeInformation

此脚本检索 Office 365 租户中的所有用户，收集他们的上次登录信息，并将结果输出到 CSV 报告。