Opselith
POWERSHELL / MICROSOFT.GRAPH.USERS
ProAdvancedRead-onlylow

Export Entra sign-in activity

Export Microsoft Entra user sign-in activity timestamps to CSV with PowerShell for account review and investigation.

Open in PowerShell Builder →Browse all scripts

Pro generation after license validation · Review before running · Opselith does not connect to your tenant

What this PowerShell script does

Exports users with their sign-in activity timestamps when available

Requirements

    Environment

    • Module: Microsoft.Graph.Users
    • Permissions: AuditLog.Read.All; User.Read.All; Microsoft Entra ID P1/P2 for signInActivity details
    • Output: CSV report
    • Context: Microsoft Graph PowerShell
    • Risk: Low
    Review before you run The full Pro script is generated by Opselith after license validation. Test outside production first.
    NEXT STEP

    Ready to generate

    Configure Export Entra sign-in activity in the Builder, review the generated PowerShell and run it yourself in your own PowerShell session.

    Configure this script →Open Builder
    More about this script

    Why use this template?

    Use this Pro PowerShell script when you need to export users with their sign-in activity timestamp when available. It can be previewed in the Builder; Pro access is required to generate it for your own environment.

    The template uses Microsoft.Graph.Users and requires AuditLog.Read.All; User.ReadBasic.All. Output: CSV report. Level: Advanced. Action: Read-only. Risk: Low.

    Review before running

    The script remains preview-only until Pro access is enabled. Review it before running it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.

    Preview the script

    1. Open the template in the PowerShell Builder.
    2. Review the purpose, requirements, permissions, output and risk.
    3. Activate Pro when you are ready to generate the full script, then test it outside production.

    Pro templates remain previewable before purchase or activation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.Preview Export Entra sign-in activity →

    How to use this result

    Use this report to compare available sign-in activity timestamps across Entra users without changing accounts.

    When this helps

    • Review recent account activity before lifecycle or access decisions.
    • Compare last successful sign-in with interactive and non-interactive sign-in timestamps.

    How to read the result

    • LastSignIn and LastNonInteractiveSignIn can represent sign-in attempts and can include failures; LastSuccessfulSignIn is the better signal for actual successful access.
    • Sign-in activity can lag and should be combined with other evidence for high-impact account decisions.

    Things to check

    • Microsoft Entra ID P1/P2 licensing and the documented Graph permissions are required for signInActivity details.
    • A blank timestamp is not by itself proof that an account has never been used.

    What to do next: Use the report to identify accounts needing review, then verify important cases with sign-in logs and business ownership before disabling access.

    Related tasks

    Official references

    Before you runModule, permissions, inputs, compatibility and script checks
    OPS / SCRIPT DETAILS

    Script details

    Exports users with their sign-in activity timestamps when available Review these details before generating or running the script.

    entraexportusers
    Generated here. Run by you.Opselith does not connect to your tenant or run PowerShell. After generating, review the script and run it in your own PowerShell session.

    What it works with

    Module: Microsoft.Graph.Users

    Microsoft Graph PowerShell lets the script work with Microsoft Entra and Microsoft 365 data through Microsoft Graph.

    Context: Microsoft Graph PowerShell

    Compatibility: PowerShell 7 is the supported target for this cloud template.

    Permissions and changes

    Permissions: AuditLog.Read.All; User.Read.All; Reports Reader (or an equivalent supported reader role); Microsoft Entra ID P1/P2 for signInActivity details

    Risk: Low

    Read-only: designed to collect information without intentionally changing the target environment.

    Changes: Read-only. The script reads data and does not intentionally change the target environment.

    Inputs

    • CSV output path - Example: C:\Temp\report.csv (Required)

    What to expect

    Output: CSV report

    Expect a CSV file at the path you choose. Open it in Excel or another CSV viewer and review the rows.

    Example: C:\Temp\report.csv

    This template is in the Pro library. Generating the full script requires eligible Pro or tester access. Opselith receives only the values needed to build the script; it does not connect to your tenant, run PowerShell or store the generated script. You review and run the result in your own PowerShell session.

    Example use

    Exports users with their sign-in activity timestamps when available

    Enter the required values in the Builder, review the generated script and confirm the output before running it.

    Before you run: Make sure your account has AuditLog.Read.All; User.Read.All; Reports Reader (or an equivalent supported reader role); Microsoft Entra ID P1/P2 for signInActivity details. Check that the Microsoft.Graph.Users PowerShell module is available and that you are using the supported PowerShell version. Review the generated script and output path, then test outside production first.
    Script checksWhat has been verifiedQA reviewed
    Static checksPassed
    PSScriptAnalyzerPending
    Real-world run testNot yet recorded
    Last checkedNot yet recorded

    Real-world run results are shown only after Opselith reviews and accepts a tester report.

    Tester: report a result →
    TEST STATUSWhat Opselith has checked

    Last reviewed: 28 Aug 2026

    PSScriptAnalyzer: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.

    Pending or Not yet recorded means there is no accepted result on file yet. A passed analyzer check does not mean the script has been run in a real tenant.

    PRACTICAL GUIDE

    How to use this result

    Use this report to review user sign-in activity while keeping successful access separate from sign-in attempts.

    When this helps

    • Find accounts with no recent successful sign-in for a lifecycle review.
    • Compare interactive, successful and non-interactive activity for account investigations.
    • Create a point-in-time activity export before access cleanup.

    How to read the result

    • LastSignIn and LastNonInteractiveSignIn can include failed attempts; LastSuccessfulSignIn is the stronger field for actual successful access.
    • Sign-in activity can lag, so timestamps should be treated as administrative evidence rather than real-time session telemetry.

    Things to check

    • Do not disable an account solely because one activity field is blank or old; verify account purpose and other evidence.
    • The signInActivity details require the documented permissions and applicable Entra licensing shown in the template.
    What to do next: Use LastSuccessfulSignIn as the primary review signal, then validate business ownership and exception cases before any lifecycle action.
    NEXT IN THE LIBRARY

    Scripts for similar admin tasks and Microsoft services.

    Browse Microsoft Entra PowerShell scripts →
    POWERSHELLExport disabled Entra usersentra · export · usersPOWERSHELLExport Entra guest usersentra · export · usersPOWERSHELLExport licensed Entra usersentra · export · users