Export Office 365 Users Real Last Logon Time Report to CSV

This PowerShell script exports Office 365 users' real last logon time using LastUserActionTime attribute, which gives more accurate data than LastLogonTime attribute. Additionally this script exports mailboxes' inactive days, creation time, Assigned licenses, Admin roles, etc

5 Star
2,342 times
Add to favorites
Office 365
E-mail Twitter del.icio.us Digg Facebook
  • new cmdlets
    2 Posts | Last post March 02, 2020
    • is this still working with the new V2 cmdlets - exomailboxstatitics?
      i modified the script with the new cmdlets - buts lastaction for all reads never logged in
    • Hi,
      Get-ExoMailboxStatistics supports limited attributes only. It doesn't return LastUserActionTime. So you can't use ExoMailboxStatistics cmdlet in this script.
      I'd suggest you use Get-MailboxStatistics cmdlet available in the V2 module (V2 module has backward compatibility to old cmdlets).
  • Not accurate?
    2 Posts | Last post November 14, 2019
    • Most of my users in email today with outlook and mobile devices show 1-6 days inactive.  Even myself shows 2 days.  I have one user with an office 365 mailbox that uses Outlook on Mac, and iphone everyday. She is in email right now. Script shows last was 18 days ago.  We are hybrid, but there are no mailbox onprem, nor does email delivery flow onprem. Any idea? 
    • Hi Jason,
      This script retrieves users' last activity time from Get-MailboxStatistics cmdlet.
      $LastActivityTime=(Get-MailboxStatistics -Identity <UPN>).LastUserActionTime
      Are you using any connector? If this is not a case, you shall raise a ticket to Microsoft. Let us know the reason once the case is resolved. It will be helpful if anybody else has the same problem.
  • Very Useful Script
    1 Posts | Last post July 19, 2019
    • Thank you.  This script was very useful for us.  Understood that this is Exchange only but still very telling about inactive employees and license usage.  You mention a script that will check all O365 services last action.  Not to push but would be very interested to know when that will be available.  Thanks.
  • Still not quite accurate
    2 Posts | Last post July 17, 2019
    • Hi Kathy, me again,
      This still doesn't appear to report accurately. A result showed a user whose last action time was 500 days ago, yet they were tracked as recent as 7 days ago including successful sign ins to ‘Office 365 Exchange Online’. That does look to be an a freak result though, but, it's a result none the less, so it looks like further validation somewhere, is required.
    • Hi Lapierre,
      Is this Hybrid environment?
  • Appears to not do what it says in the title
    2 Posts | Last post July 08, 2019
    • You claim that this tracks the users real last login.
      However, that is incorrect, as far as I can tell, it tracks a users last login to EXCHANGE ONLINE.
      If a user doesn't use Exchange Online but does use other O365 capabilities like SharePoint or ODfB, does it track their logins?
      Regards, J.
    • People are more active in the mail than other Office 365 services (in most cases). That's why people use Get-Mailboxstatisctis (Which shows stats about Exchange Online alone) to identify inactive mailboxes.
      Since LastLogonTime(which retrieved from Get-MailboxStatistics cmdlet) attribute also indicates the time when the background tasks access the mailbox, we proposed this script to show real users' last activity in Exchange mailbox.
      We are also working on a script which analyses the audit logs to produce last activity time based on each Office 365 service separately.