Get-MgAuditLogSignIn

What is Get-MgAuditLogSignIn?

The Get-MgAuditLogSignIn cmdlet in Microsoft Graph PowerShell retrieves sign-in activity logs for users in a Microsoft 365 tenant. It provides insights into login events, including user, location, IP address, and status.

Why Use Get-MgAuditLogSignIn?

Monitoring sign-ins is crucial for security and compliance. With Get-MgAuditLogSignIn, administrators can:

• Audit sign-in activity across the tenant.
• Investigate suspicious logins.
• Generate reports on user access patterns.
• Automate compliance checks and export logs for analysis.

Prerequisites

Before using this cmdlet, connect to Microsoft Graph with the required audit log permissions:

Connect-MgGraph -Scopes "AuditLog.Read.All"

How to Use Get-MgAuditLogSignIn?

Syntax (essential parameters):

Get-MgAuditLogSignIn [-Top <Int32>] [-Filter <String>] [-Select <String>]

You can limit the number of results, filter based on event ID, or query by date/time for targeted auditing.

Get-MgAuditLogSignIn Examples

• Example 1: Retrieve Top 10 Sign-In Activities

Get-MgAuditLogSignIn -Top 10

This command retrieves the top 10 most recent sign-in activities.

• Example 2: Retrieve Sign-In Activity Based on Specific ID

$signInId = "f2315678-1234-7890-dr45-p09o8iu76y"
$detailedSignIn = Get-MgAuditLogSignIn -Filter "id eq '$signInId'"
$detailedSignIn

Since every user sign-in event has an ID, you can pass it to fetch details of a specific sign-in.

• Example 3: Audit Sign-In Activity for the Past 30 Days

$startDate = (get-date).AddDays(-30).ToString("yyyy-MM-ddTHH:mm:ssZ")
$signIns = Get-MgAuditLogSignIn -Filter "createdDateTime ge $startDate"
$signIns | Select-Object userPrincipalName, createdDateTime, ipAddress, location, status

This script retrieves user sign-in activity for the last 30 days, including usernames, login times, IPs, and status.