IsInteractive: Whether or not the user signed in manually, or if it was through automation.CreatedDateTime: Date and Time of when the sign-in occurred.Our report would include something similar to the following: In this instance, we’re going to focus our efforts on compiling an Azure last login report using PowerShell. If you recall, I wrote a previous post to Get Last Logon Date For All Users in Your Domain, but that script is specifically for Onprem Active Directory domain activity. You can even save your search as a custom report that you can subscribe stakeholders to, and set up an alert to ensure you’re immediately on top of any suspicious sign-in attempt.Every so often when I run an audit on my environment, I’m always finding myself needing to check recent activity logs to specifically get Azure AD last login date and sign-in activity. The convenient search function enables you to filter out unnecessary records and quickly find the information you are looking for. Netwrix Auditor for Azure AD facilitates access control for security and compliance by providing security reports on both successful and failed attempts to access your Azure AD and cloud applications. The Azure Active Directory audit logs record all logon events, but you cannot effectively filter the entries to exclude known (safe) locations, leaving you with an impossible volume of information to process manually. Nevertheless, with so many remote workers and cloud applications, your attack surface is significantly larger, and therefore it’s critical to keep track of Azure sign-in events. In particular, we can no longer rely on traditional firewall rules to control access, especially as threats become more sophisticated.Īzure Active Directory conditional access policies enable you to control user access to resources and even implement MFA based on sign-in location. While most of the challenges related to getting remote workers up and running have been addressed, there are still serious security challenges. Many organizations have been operating with an expanded remote workforce for several months now. How to Detect Logons Outside of Trusted Locations in Azure AD.

Azure ad sign in