Is there a query to run so I can get a list of users who has NOT logged in, in the past 30 days?

Question

I am trying to create a query that gives me a list of all users who have NOT logged into Azure or any services connected with azure in the last 30 days. This query would start at 30 days and go back. Also, the account would have to be active, not 1 that is deleted already.

Any thoughts on how to complete this would be appreciated!

Answer 1

I guess, you may get this requirement done with Graph API to get the list of all users who have not had any login activity in last 30 days:

https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-beta&tabs=http#example-5-list-the-last-sign-in-time-of-users-in-a-specific-time-range

If Graph API is not feasible then the Diagnostic Settings from Azure under Monitoring can be leveraged to build the logic for getting the list of users per requirement and then the query copied:

https://2bcloud.io/inactive-users-in-azure-active-directory/

https://social.msdn.microsoft.com/Forums/en-US/0e1869fb-2861-4a43-9ff3-5b988da7edd0/inactive-users-report-for-azure-active-directory-applications?forum=WindowsAzureAD