User last activity
Find information about the user last activity, including: when the account was created, last time user signs-in (sign-in activity) and last time they reset their password.
Prerequisites
Before you start make sure you have configured the following:To get the user's properties, sign-in to the Microsoft Entra admin center and browse to Identity > Users > All users. Then, search and select the user you want to get the properties.
![](/Help/Activity/Select-user.png)
On the User page, select the Properties tab and check the relevant properties, like Created date time and Last password change date time. Note, user sign-in activity currently available only via Microsoft Graph or PowerShell. You can also check the sign-in log.
![](/Help/Activity/User-properties.png)
Dependencies
This script is self-contained.1. Get user last activity
GET https://graph.microsoft.com/v1.0/users/{user-id}?$select=displayName,createdDateTime,lastPasswordChangeDateTime,signInActivity
Connect-MgGraph -Scopes "User.Read.All AuditLog.Read.All"
Get-MgUser -UserId {user-id} -Property "displayName,CreatedDateTime,lastPasswordChangeDateTime,signInActivity"
GET https://graph.microsoft.com/v1.0/users/11111111-0000-0000-0000-000000000000?$select=displayName,createdDateTime,lastPasswordChangeDateTime,signInActivity
Get-MgUser -UserId 11111111-0000-0000-0000-000000000000 -Property "displayName,CreatedDateTime,lastPasswordChangeDateTime,signInActivity"
2. Investigate user last activity
From the response, check the:- createdDateTime - The date and time the user was created. The value cannot be modified and is automatically populated when the user is created.
- lastPasswordChangeDateTime - The time when the user last changed their password.
- signInActivity - Provides the last interactive or non-interactive sign-in attempt time for a specific user.
{ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(displayName,createdDateTime,lastPasswordChangeDateTime,signInActivity)/$entity", "displayName": "Nicholas", "createdDateTime": "2024-07-22T17:59:47Z", "lastPasswordChangeDateTime": "2024-07-22T17:59:47Z", "id": "11111111-0000-0000-0000-000000000000", "signInActivity": { "lastSignInDateTime": "2024-07-22T17:59:53Z", "lastSignInRequestId": "9c8146c5-8cbc-419c-b34b-47a3579c0000", "lastNonInteractiveSignInDateTime": null, "lastNonInteractiveSignInRequestId": null, "lastSuccessfulSignInDateTime": "2024-07-22T17:59:53Z", "lastSuccessfulSignInRequestId": "9c8146c5-8cbc-419c-b34b-47a3579c0000" } }