Is it possible to see the login history on Office 365?
I would like to know if it's possible to see the login history on Office 365, and eventually the login attempts as well? Seems like the consumer version of Outlook has this but I can't find anything like it on 365.
Thanks.
Solution 1:
Login history can be searched through Office 365 Security & Compliance Center. In the left pane, click Search & investigation, and then click Audit log search. Please notice that for User activity in Exchange Online (Exchange mailbox audit logging) you need to have mailbox audit logging turned on for each user. Please see Technet article Enable mailbox auditing in Office 365.
Office 365 Admin center Home > Usage > Email activity only shows the last activity time of every user and it doesn't report login failures.
If you have concerns about unauthorized logins, you could improve your security by setting up multi-factor authentication for your users. I recommend this at least for users that have administrative roles.
Solution 2:
Yes, it's possible to see the login history on office 365. but its very tedious task.
Login operation is denoted by more than 10 events. Following are few of the known login events.
- UserLoggedIn
- UserLoginFailed
- PasswordLogonInitialAuthUsingPassword
- foreignrealmindexlogoncookiecopyusingdatoken
- foreignrealmindexlogoncookiecopyusingsha1remembermypassword
- foreignrealmindexlogoninitialauthusingadfsfederatedtoken
- passwordlogoncookiecopyusingdatoken
- passwordlogoninitialauthusingadfsfederatedtoken
- passwordlogonsilentreauthusingdatoken
To check the login success/failure cases, you need to verify the result status for the above operations.
Easy Solution:
You can try the AdminDroid Office 365 Auditing Tool to get the login activities either by report or through the visually appealing dashboards.
Solution 3:
Recently, I found this script. Thought of sharing here.
Export Office 365 users login history report
This report contains both successful and failed login attempts. Also, the script has more advanced filtering options to get successful login attempts, failed login attempts, login history of specific user or a list of users, login history within a specific period, etc.
Sample Output:
Solution 4:
They've added a new page to the portal where you can very easily check your recent sign-ins including IP/location, success and failure along with some more details: https://mysignins.microsoft.com/