14

I would like to know if it's possible to see the login history on Office 365, and eventually the login attempts as well? Seems like the consumer version of Outlook has this but I can't find anything like it on 365.

Thanks.

15

Login history can be searched through Office 365 Security & Compliance Center. In the left pane, click Search & investigation, and then click Audit log search. Please notice that for User activity in Exchange Online (Exchange mailbox audit logging) you need to have mailbox audit logging turned on for each user. Please see Technet article Enable mailbox auditing in Office 365.

Office 365 Admin center Home > Usage > Email activity only shows the last activity time of every user and it doesn't report login failures.

If you have concerns about unauthorized logins, you could improve your security by setting up multi-factor authentication for your users. I recommend this at least for users that have administrative roles.

| improve this answer | |
  • 2
    MFA was actually set up. I just had a 2FA SMS which I didn't request and wanted to confirm whether it was just a delayed text that came through or if someone actually attempted login. – André Borie Mar 24 '17 at 10:56
  • 1
    Menus have changed (as of 2019-07). To run an Audit Log Search, go to Office 365 Security & Compliance home, locate the Search & Investigation pane in the right column, then click Search for admin and user activity. I could not figure out how to get back there using the left-side navigation. – joemaller Jul 7 '19 at 13:37
  • Also, for EMS licenced users there's now Microsoft Cloud App Security, giving quite more readable searches and possibility to detect anomalies, with alerts. Hint: EMS E5 is only required for investigating the audit data and managing alerts, while E3 is enough for collecting the data from rest of the users. – Esa Jokinen Jul 8 '19 at 8:18
3

Yes, it's possible to see the login history on office 365. but its very tedious task.

Login operation is denoted by more than 10 events. Following are few of the known login events.

  • UserLoggedIn
  • UserLoginFailed
  • PasswordLogonInitialAuthUsingPassword
  • foreignrealmindexlogoncookiecopyusingdatoken
  • foreignrealmindexlogoncookiecopyusingsha1remembermypassword
  • foreignrealmindexlogoninitialauthusingadfsfederatedtoken
  • passwordlogoncookiecopyusingdatoken
  • passwordlogoninitialauthusingadfsfederatedtoken
  • passwordlogonsilentreauthusingdatoken

To check the login success/failure cases, you need to verify the result status for the above operations.

Easy Solution:

You can try the AdminDroid Office 365 Auditing Tool to get the login activities either by report or through the visually appealing dashboards.

Login Activities Dashboard enter image description here

| improve this answer | |
  • 3
    What's your affiliation with that tool? – Esa Jokinen Nov 24 '17 at 20:15
  • I am one of the developers of the tool. – Ember Freak Nov 26 '17 at 3:41
  • Kudos for acknowledging that it's a hassle to get the info out. If the method has improved in the last few months, we'd love to hear about it. – Christopher Hostage Jun 26 '18 at 16:36
  • Still, it's same. No improvements – Ember Freak Jun 27 '18 at 9:56
2

Recently, I found this script. Thought of sharing here.

Export Office 365 users login history report

This report contains both successful and failed login attempts. Also, the script has more advanced filtering options to get successful login attempts, failed login attempts, login history of specific user or a list of users, login history within a specific period, etc.

Sample Output:

login history report

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.