Logon History For Single AD User

Question

I am looking for a Powershell script that can list the logon history for a specific user. I have searched all over and everything I am finding is getting a report for ALL AD users logon history. What I need is to specify by username all logon attempts within a specific time frame. Any help is GREATLY appreciated!!

Answer 1

You can use Get-AzureADAuditSignInLogs cmdlet to get the user sign-in activities. You need to add -Filter to the cmdlet to get logs of a specific user e.g.

Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1'"

You can also combine CreatedDateTime in -filter to filter events occurred based on time. e.g.

Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'user 1' and createdDateTime gt 2020-04-21T10:30:00.0Z"