17

I would like to know if it's possible to see the login history on Office 365, and eventually the login attempts as well? Seems like the consumer version of Outlook has this but I can't find anything like it on 365.

Thanks.

4 Answers 4

18

Login history can be searched through Office 365 Security & Compliance Center. In the left pane, click Search & investigation, and then click Audit log search. Please notice that for User activity in Exchange Online (Exchange mailbox audit logging) you need to have mailbox audit logging turned on for each user. Please see Technet article Enable mailbox auditing in Office 365.

Office 365 Admin center Home > Usage > Email activity only shows the last activity time of every user and it doesn't report login failures.

If you have concerns about unauthorized logins, you could improve your security by setting up multi-factor authentication for your users. I recommend this at least for users that have administrative roles.

3
  • 2
    MFA was actually set up. I just had a 2FA SMS which I didn't request and wanted to confirm whether it was just a delayed text that came through or if someone actually attempted login. Mar 24, 2017 at 10:56
  • 2
    Menus have changed (as of 2019-07). To run an Audit Log Search, go to Office 365 Security & Compliance home, locate the Search & Investigation pane in the right column, then click Search for admin and user activity. I could not figure out how to get back there using the left-side navigation.
    – joemaller
    Jul 7, 2019 at 13:37
  • Also, for EMS licenced users there's now Microsoft Cloud App Security, giving quite more readable searches and possibility to detect anomalies, with alerts. Hint: EMS E5 is only required for investigating the audit data and managing alerts, while E3 is enough for collecting the data from rest of the users. Jul 8, 2019 at 8:18
3

Yes, it's possible to see the login history on office 365. but its very tedious task.

Login operation is denoted by more than 10 events. Following are few of the known login events.

  • UserLoggedIn
  • UserLoginFailed
  • PasswordLogonInitialAuthUsingPassword
  • foreignrealmindexlogoncookiecopyusingdatoken
  • foreignrealmindexlogoncookiecopyusingsha1remembermypassword
  • foreignrealmindexlogoninitialauthusingadfsfederatedtoken
  • passwordlogoncookiecopyusingdatoken
  • passwordlogoninitialauthusingadfsfederatedtoken
  • passwordlogonsilentreauthusingdatoken

To check the login success/failure cases, you need to verify the result status for the above operations.

Easy Solution:

You can try the AdminDroid Office 365 Auditing Tool to get the login activities either by report or through the visually appealing dashboards.

Login Activities Dashboard enter image description here

4
  • 3
    What's your affiliation with that tool? Nov 24, 2017 at 20:15
  • I am one of the developers of the tool. Nov 26, 2017 at 3:41
  • Kudos for acknowledging that it's a hassle to get the info out. If the method has improved in the last few months, we'd love to hear about it. Jun 26, 2018 at 16:36
  • Still, it's same. No improvements Jun 27, 2018 at 9:56
3

Recently, I found this script. Thought of sharing here.

Export Office 365 users login history report

This report contains both successful and failed login attempts. Also, the script has more advanced filtering options to get successful login attempts, failed login attempts, login history of specific user or a list of users, login history within a specific period, etc.

Sample Output:

login history report

2

They've added a new page to the portal where you can very easily check your recent sign-ins including IP/location, success and failure along with some more details: https://mysignins.microsoft.com/

Not the answer you're looking for? Browse other questions tagged or ask your own question.