In this blog will discuss how to see the user login history and activity in Office 365.
The Office 365 user’s login history can be searched through Office 365 Security & Compliance Center. In the left pane, click Search & investigation, and then click Audit log search.
Proceed with this link: https://protection.office.com/
Here’s the process for searching the audit log in Office 365.
Step 1: Run an audit log search
Step 2: View the search results
Step 3: Filter the search results
Step 4: Export the search results to a file
Search the audit log in the Office 365 Security & Compliance Center.
Keep in mind to track the User activity in Exchange Online (Exchange mailbox audit logging) you need to have mailbox audit logging turned on for each user. Please see our article i.e. Enable mailbox auditing in Office 365.
In Office 365 Admin center Home > Usage > Email activity will shows the last activity time of every user and it doesn’t report login failures.
The best and recommended way to deal with unauthorized logins is setting up multi-factor authentication; you could improve your security by using this for your users. This can be recommending at least for users that have administrative roles. For more information – Multi-Factor and 2-Factor Authentication (2FA) and why you should use it.
Get an Office 365 user statistics report by using GetMsolUserReport.ps1 script. You will need to download and install Microsoft Online services for Windows PowerShell, to work with this script.
By following above steps you can see the user login history, statistics and activity reports in the Office 365.