Skip to main content

aad user signin list

Retrieves the Azure AD user sign-ins for the tenant

Usage​

m365 aad user signin list [options]

Options​

-n, --userName [userName]

Filter the user sign-ins by given User's UPN (user principal name), eg. johndoe@example.com. Specify either userName or userId

--userId [userId]

Filter the user sign-ins by given User's Id. Specify either userName or userId

--appDisplayName [appDisplayName]

Filter the user sign-ins by the given application display name. Specify either appDisplayName or appId

--appId [appId]

Filter the user sign-ins by the given application identifier. Specify either appDisplayName or appId

-h, --help [help]

Output usage information. Optionally, specify which section of command's help you want to see. Allowed values are options, examples, remarks, response, full. Default is options.

--query [query]

JMESPath query string. See http://jmespath.org/ for more information and examples.

-o, --output [output]

Output type. json, text, csv, md, none. Default json.

--verbose

Runs command with verbose logging.

--debug

Runs command with debug logging.

Examples​

Get all user's sign-ins in your tenant

m365 aad user signin list

Get all user's sign-ins filter by given user's UPN in the tenant

m365 aad user signin list --userName 'johndoe@example.com'

Get all user's sign-ins filter by given user's Id in the tenant

m365 aad user signin list --userId '11111111-1111-1111-1111-111111111111'

Get all user's sign-ins filter by given application display name in the tenant

m365 aad user signin list --appDisplayName 'Graph explorer'

Get all user's sign-ins filter by given application identifier in the tenant

m365 aad user signin list --appId '00000000-0000-0000-0000-000000000000'

Get all user's sign-ins filter by given user's UPN and application display name in the tenant

m365 aad user signin list --userName 'johndoe@example.com' --appDisplayName 'Graph explorer'

Get all user's sign-ins filter by given user's Id and application display name in the tenant

m365 aad user signin list --userId '11111111-1111-1111-1111-111111111111' --appDisplayName 'Graph explorer'

Get all user's sign-ins filter by given user's UPN and application identifier in the tenant

m365 aad user signin list --userName 'johndoe@example.com' --appId '00000000-0000-0000-0000-000000000000'

Get all user's sign-ins filter by given user's Id and application identifier in the tenant

m365 aad user signin list --userId '11111111-1111-1111-1111-111111111111' --appId '00000000-0000-0000-0000-000000000000'

Response​

[
  {
    "id": "66ea54eb-6301-4ee5-be62-ff5a759b0100",
    "createdDateTime": "2020-03-13T19:15:41.6195833Z",
    "userDisplayName": "Test Contoso",
    "userPrincipalName": "john@contoso.com",
    "userId": "26be570a-ae82-4189-b4e2-a37c6808512d",
    "appId": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
    "appDisplayName": "Graph explorer",
    "ipAddress": "131.107.159.37",
    "clientAppUsed": "Browser",
    "correlationId": "d79f5bee-5860-4832-928f-3133e22ae912",
    "conditionalAccessStatus": "notApplied",
    "isInteractive": true,
    "riskDetail": "none",
    "riskLevelAggregated": "none",
    "riskLevelDuringSignIn": "none",
    "riskState": "none",
    "riskEventTypes": [],
    "resourceDisplayName": "Microsoft Graph",
    "resourceId": "00000003-0000-0000-c000-000000000000",
    "status": {
      "errorCode": 0,
      "failureReason": null,
      "additionalDetails": null
    },
    "deviceDetail": {
      "deviceId": "",
      "displayName": null,
      "operatingSystem": "Windows 10",
      "browser": "Edge 80.0.361",
      "isCompliant": null,
      "isManaged": null,
      "trustType": null
    },
    "location": {
      "city": "Redmond",
      "state": "Washington",
      "countryOrRegion": "US",
      "geoCoordinates": {
        "altitude": null,
        "latitude": 47.68050003051758,
        "longitude": -122.12094116210938
      }
    },
    "appliedConditionalAccessPolicies": [
      {
        "id": "de7e60eb-ed89-4d73-8205-2227def6b7c9",
        "displayName": "SharePoint limited access for guest workers",
        "enforcedGrantControls": [],
        "enforcedSessionControls": [],
        "result": "notEnabled"
      },
      {
        "id": "6701123a-b4c6-48af-8565-565c8bf7cabc",
        "displayName": "Medium signin risk block",
        "enforcedGrantControls": [],
        "enforcedSessionControls": [],
        "result": "notEnabled"
      }
    ]
  }
]
CTRL + M