What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To find potentially inactive Microsoft 365 users, query Microsoft Graph for each user’s signInActivity, compare the appropriate timestamp with an organization-approved cutoff, and review the resulting candidates before changing access. For actual account access, use lastSuccessfulSignInDateTime when available; lastSignInDateTime records attempts, including failures.
Which sign-in timestamp should you use?
Microsoft Graph exposes three useful timestamps on the user object. They describe different kinds of activity, so the field you choose determines what your report can reasonably claim.
As an Amazon Associate I earn from qualifying purchases.
| Graph property | What it represents | How to interpret it |
|---|---|---|
lastSignInDateTime |
Most recent interactive sign-in attempt, successful or unsuccessful. | Useful as an attempt-history signal, but an old value does not establish that the account has not been accessed. |
lastNonInteractiveSignInDateTime |
Most recent non-interactive sign-in attempt. | Supporting context: some clients access tenant resources without a user directly signing in. |
lastSuccessfulSignInDateTime |
Most recent successful interactive or non-interactive sign-in. | Prefer this when the question is when the account was actually accessed. |
Microsoft documents interactive sign-in history back to April 2020 and non-interactive history back to May 2020. The successful-sign-in property became available on December 1, 2023, and earlier values were not backfilled. A blank timestamp can therefore mean no recorded attempt or activity outside the available history; it is not proof that the account was never used. See Microsoft’s signInActivity resource reference.
How do I find potentially inactive users with PowerShell?
Use Microsoft Graph PowerShell to request the user identifiers needed for review and explicitly select signInActivity. The property is not returned by default. This example uses the successful interactive or non-interactive timestamp, and treats a missing value separately rather than asserting that the user is inactive.
#1 Best Overall
- Instant Copilot. Unlock new possibilities with the dedicated Copilot key, which gives you instant access to experiences that can enhance your productivity¹.
- Enhance your experience With the new microphone mute key and snipping key
- Full keyboard experience. Features a full mechanical keyset, backlit keys, and a large trackpad for precise navigation and control. Optimal key spacing allows fast, fluid typing.
- Slim and compact Performs like a traditional, full-size keyboard.
- Clicks in place instantly Use in combination with the Surface Pro (11th Edition), Pro 9 and Pro 8* kickstand for a perfect laptop experience anywhere.
Connect-MgGraph -Scopes "AuditLog.Read.All","User.Read.All"
$users = Get-MgUser -All -Property `
"displayName,userPrincipalName,accountEnabled,signInActivity"
$cutoff = (Get-Date).ToUniversalTime().AddDays(-120)
$report = foreach ($user in $users) {
$lastSuccessful = $user.SignInActivity.LastSuccessfulSignInDateTime
if ($null -eq $lastSuccessful) {
$status = "No successful sign-in timestamp recorded"
}
elseif ([datetime]$lastSuccessful -lt $cutoff) {
$status = "Candidate: last successful sign-in is before cutoff"
}
else {
$status = "Recent successful sign-in"
}
[pscustomobject]@{
DisplayName = $user.DisplayName
UserPrincipalName = $user.UserPrincipalName
AccountEnabled = $user.AccountEnabled
LastSuccessfulSignInDateTime = $lastSuccessful
LastSignInDateTime = $user.SignInActivity.LastSignInDateTime
LastNonInteractiveSignInDateTime = $user.SignInActivity.LastNonInteractiveSignInDateTime
CutoffUtc = $cutoff
ReviewStatus = $status
}
}
$report | Export-Csv -Path ".sign-in-review.csv" -NoTypeInformationThe 120-day cutoff is an example parameter for the script, not a universal inactivity rule. Choose a period that matches your organization’s policy before running the report. The Microsoft Graph PowerShell connection scopes shown are examples; verify the current least-privileged permissions for your tenant, endpoint, and delegated or application access model before granting consent.
Make sure the report includes every page
Get-MgUser -All asks the SDK to follow result pages. This matters because Microsoft Graph documents a maximum page size of 500 when signInActivity is selected or filtered in the users-list operation. Do not assume one response contains every user. Check the users list API reference for selection, filtering, and paging constraints.
Rank #2
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
How should you choose an inactivity cutoff?
There is no universal period that makes an account inactive. Microsoft Learn says organizations should decide what “for a while” means in their own environment and offers 90–180 days as an example reasonable window. That is guidance, not a mandated default or measured statistic. Account for legitimate absences such as vacation, and consider account purpose and business context when selecting a threshold. See Microsoft’s guidance on inactive accounts.
Keep the report’s claim aligned with its field: an old lastSignInDateTime indicates an old interactive attempt, not necessarily a lack of successful access. Use lastSuccessfulSignInDateTime for the access question when it is populated, and review the non-interactive timestamp as supporting context. Include the chosen field, cutoff, and treatment of blank values in the report so reviewers can understand what a candidate means.
Rank #3
- Microsoft Natural Ergonomic Palm Rest Comfort Keyboard for Business - Wired
- Exceptional comfort. Work all day, with reduced risk of fatigue and injury, on our Ergonomist-approved design.
- Excellent support. Improved cushion and ergonomically tested palm rest covered in premium fabric provides all-day comfort and promotes a neutral wrist posture.
- Be more productive with built-in shortcuts, including dedicated keys for office 365,* emojis, search, easy access to media controls, and more.
- Designed to last wired for reliable speed and accuracy. Crunch numbers Fast, with a dedicated integrated pad. Compatibility: Microsoft Windows 10, Limited functionality Windows 8.1/7 (Office and Emoji keys have no function)
What permissions and licensing are required?
Requirements depend on the endpoint and whether access is delegated or application-based. Microsoft’s users-list reference states that reading signInActivity requires Microsoft Entra ID P1 or P2 and AuditLog.Read.All. For sign-in logs, the v1.0 sign-ins endpoint lists AuditLog.Read.All as its least-privileged permission and supports delegated roles including Reports Reader and Security Reader. Microsoft’s activity-log guidance also describes P1 or P2 licensing and gives AuditLog.Read.All and Directory.Read.All in examples. Confirm the current requirements for the access path you will use rather than granting broad directory permissions by default. References: users list, sign-in logs list, and manage inactive user accounts.
How should you review candidates before taking action?
A timestamp-based report is a screening tool, not an automatic disablement decision. Check each candidate with the account owner or responsible administrator before changing access.
- Confirm employment or contractor status and whether the person is on leave.
- Verify the account type and whether it is a shared, service, emergency-access, or other operational account.
- Check business need and relevant workload context; some clients may access resources non-interactively.
- Investigate blank timestamps instead of treating them as proof of non-use.
- Record the timestamp field, cutoff, review outcome, and approval before disabling or removing access.
Recent activity can take time to appear: Microsoft says interactive attempts typically show in the related sign-in report within six hours, while the user object’s timestamp can take up to 24 hours to update. Allow for this lag when investigating a very recent sign-in.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11When should you inspect sign-in or directory audit logs?
User-object timestamps summarize recent activity; they are not a substitute for examining specific events. For an investigation into a particular sign-in or a directory change, Microsoft Graph PowerShell provides Get-MgAuditLogSignIn and Get-MgAuditLogDirectoryAudit. Use event-level logs to examine the details relevant to the incident, while interpreting user summary fields according to what each timestamp records. See Microsoft’s Get-MgAuditLogSignIn and Get-MgAuditLogDirectoryAudit references.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
