I am looking at collecting some data about m365 users in the graph api. I am looking to also select the user/users lastSignInDateTime property which is in the auditlog file.
I do not want/need to give/ask customers for the AuditLog.Read.All permission as it exposes a lot of other information about the usrs activity.
Is there a more granular approach to just getting this one property or is AuditLog.Read.All the only sane/doable option at the moment?
is AuditLog.Read.All the only sane/doable option at the moment
--> I'm afraid yes, and I trust you already had the api property document. What I want to write here is that before we have a document to say about it, we could say what we have in the document is the most correct.
lastSignInDateTime
is a property exposed by the signInActivity resource type, which would be return when calling getting-user-graph-api, and let's see the property description, it mentioned
Details for this property require a Microsoft Entra ID P1 or P2 license and the AuditLog.Read.All permission
By the way, the api permission doesn't mean everything during the procress calling graph api. And after adding the permission, it doesn't mean that we need to ask users to consent it, this api permission is "Admin consent required" permission which should get consent by admin in advance. We just need to protect the client secret well, we don't need to worry that someone else would use this aad app to query some other information.