Only successful Teams logins are captured in Search-UnifiedAuditLog. Note: Since вЂMicrosoft TeamsвЂ™ login doesnвЂ™t have an IP address and Result status column, it shown as empty. The exported login history report looks similar below screenshot Our Logon history report tracks login events in AzureActiveDirectory ( UserLoggedIn, UserLoginFailed ), ExchangeOnline ( MailboxLogin ) and MicrosoftTeams ( TeamsSessionStarted ).I.e., credentials can be passed as a parameter instead of saving inside the script. By using advanced filtering options, you can export вЂњ Office 365 users Sign-in report вЂќ and вЂњ Suspicious login report вЂќ.You can export the report to choose either вЂњ All Office 365 usersвЂ™ login attempts вЂќ or вЂњ Specific Office userвЂ™s logon attempts вЂќ.This script can be executed with MFA enabled account.The exported report has IP addresses from where your office 365 users are login.Allows you to filter the result based on successful and failed logon attempts.Also, the script has more advanced filtering options to get successful login attempts, failed login attempts, login history of specific user or a list of users, login history within a specific period, etc.Дownload Script: O365UserLoginHistory.ps1 After getting a result, you need to filter out usersвЂ™ login attempts (both success and failure login attempts) from tons of audit entry.ДonвЂ™t worry! We have worked for you and made a user-friendly PowerShell script вЂ“ Office 365 usersвЂ™ login history report, which contains both successful and failed login attempts.

If it exceeds the limit, you canвЂ™t retrieve all records. Even if you use SessionId, you can get 50,000 records for a given period.You need to call Search- UnifiedAuditLog again and again with SessionId until you get all records. Even if you use ResultSize, you canвЂ™t guarantee, the specified range has how many records. It can be achieved by using ResultSize param. You can get a maximum of 5000 records for each Search- UnifiedAuditLog call.It has the following challenges.Д¬hallenges in using Search-UnifiedAuditLog: Getting Audit logs using the Search- UnifiedAuditLog is not an easy task. You need to process all events to filter out successful login attempts and failed login attempts. PowerShell cmdlet Search- UnifiedAuditLog is used to track all events in a specified range. To audit Office 365 userвЂ™s all successful and failed logon attempts, PowerShell is the best solution. Even if you use filters to get failed login attempts, you canвЂ™t export those failed login attempts alone. It wonвЂ™t track failed Office 365 userвЂ™s login attempts. But in the Security and Compliance Center, you can get a history of successful login attempts alone. To get Office 365 User logon history, you can use either Office 365 Security and Compliance or PowerShell. Tracking Office 365 userвЂ™s login activities is a crucial one in detecting potential security breaches and suspicious behavior. Logons are the one common activity in most attack patterns.

Office 365 login outlook