10

I would like to know if it's possible to see the login history on Office 365, and eventually the login attempts as well? Seems like the consumer version of Outlook has this but I can't find anything like it on 365.

Thanks.

10

Login history can be searched through Office 365 Security & Compliance Center. In the left pane, click Search & investigation, and then click Audit log search. Please notice that for User activity in Exchange Online (Exchange mailbox audit logging) you need to have mailbox audit logging turned on for each user. Please see Technet article Enable mailbox auditing in Office 365.

Office 365 Admin center Home > Usage > Email activity only shows the last activity time of every user and it doesn't report login failures.

If you have concerns about unauthorized logins, you could improve your security by setting up multi-factor authentication for your users. I recommend this at least for users that have administrative roles.

  • 2
    MFA was actually set up. I just had a 2FA SMS which I didn't request and wanted to confirm whether it was just a delayed text that came through or if someone actually attempted login. – André Borie Mar 24 '17 at 10:56
  • 1
    Menus have changed (as of 2019-07). To run an Audit Log Search, go to Office 365 Security & Compliance home, locate the Search & Investigation pane in the right column, then click Search for admin and user activity. I could not figure out how to get back there using the left-side navigation. – joemaller Jul 7 at 13:37
  • Also, for EMS licenced users there's now Microsoft Cloud App Security, giving quite more readable searches and possibility to detect anomalies, with alerts. Hint: EMS E5 is only required for investigating the audit data and managing alerts, while E3 is enough for collecting the data from rest of the users. – Esa Jokinen Jul 8 at 8:18
3

Yes, it's possible to see the login history on office 365. but its very tedious task.

Login operation is denoted by more than 10 events. Following are few of the known login events.

  • UserLoggedIn
  • UserLoginFailed
  • PasswordLogonInitialAuthUsingPassword
  • foreignrealmindexlogoncookiecopyusingdatoken
  • foreignrealmindexlogoncookiecopyusingsha1remembermypassword
  • foreignrealmindexlogoninitialauthusingadfsfederatedtoken
  • passwordlogoncookiecopyusingdatoken
  • passwordlogoninitialauthusingadfsfederatedtoken
  • passwordlogonsilentreauthusingdatoken

To check the login success/failure cases, you need to verify the result status for the above operations.

Easy Solution:

You can try the AdminDroid Office 365 Auditing Tool to get the login activities either by report or through the visually appealing dashboards.

Login Activities Dashboard enter image description here

  • 2
    What's your affiliation with that tool? – Esa Jokinen Nov 24 '17 at 20:15
  • I am one of the developers of the tool. – Ember Freak Nov 26 '17 at 3:41
  • Kudos for acknowledging that it's a hassle to get the info out. If the method has improved in the last few months, we'd love to hear about it. – Christopher Hostage Jun 26 '18 at 16:36
  • Still, it's same. No improvements – Ember Freak Jun 27 '18 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.