AzureADLastLoginReport

1.0

AzureADLastLoginReport.ps1

                                <#PSScriptInfo

.VERSION 1.0

.GUID 1ba45abc-d909-42d5-8cae-3ae7b7b81c2e

.AUTHOR Vikas Sukhija

.COMPANYNAME Techwizard.cloud

.COPYRIGHT Techwizard.cloud

.TAGS

.LICENSEURI

.PROJECTURI

.ICONURI

.EXTERNALMODULEDEPENDENCIES 

.REQUIREDSCRIPTS

.EXTERNALSCRIPTDEPENDENCIES

.RELEASENOTES

.PRIVATEDATA

#>

<#    

    .NOTES

    ===========================================================================

    Created with:     ISE

    Created on:       5/1/2023  1:46 PM

    Created by:       Vikas Sukhija

    Organization:     

    Filename:         AzureADLastLoginReport.ps1

    refrence:   Microsoft script

    ===========================================================================

    .DESCRIPTION

    This script will report on AzureAd last login and can send the report on designated emaail address

    also you can filter the reports based on days, like whoever has not loggedin since 90days so 

    that in case you want to deactivate guest accounts or other accounts based on that. 

    User.Read.All and AuditLog.Read.All permissions are required for the APP

#>

[CmdletBinding()]

  param

  (

    [Parameter(Mandatory = $true)]

    $DaysSinceLastLogin,

    [Parameter(Mandatory = $true)]

    [ValidateSet('guest','member','All')]

    $UserType,

    $smtpserver="smtpserver",

    $from="DoNotRespond@labtest.com",

    $erroremail="Reports@labtest.com",

    $logrecyclelimit = '60'

  ) 

#################logs and variables##########################

$log = Write-Log -Name "AzureADLastLoginReport" -folder "logs" -Ext "log"

$ReportFull = Write-Log -Name "ReportFull-AzureADLastLoginReport" -folder "Report" -Ext "csv"

$ReportActual = Write-Log -Name "ReportActual-AzureADLastLoginReport" -folder "Report" -Ext "csv"

$URI = "https://graph.microsoft.com/beta/users?`$select=displayName,userPrincipalName, mail, id, CreatedDateTime, signInActivity, UserType, assignedLicenses&`$top=999"

#####################get access token ##############################

$AppId = ''

$TenantId = ''

$AppSecret = ''

$uri = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"

 $body = @{

     client_id     = $AppId

     scope         = "https://graph.microsoft.com/.default"

     client_secret = $AppSecret

     grant_type    = "client_credentials" }

$tokenRequest = Invoke-WebRequest -Method Post -Uri $uri -ContentType "application/x-www-form-urlencoded" -Body $body -UseBasicParsing

$Accesstoken = ($tokenRequest.Content | ConvertFrom-Json).access_token

#######################get report based on days#########################

Write-Log -Message "Start....................Script" -path $log

$headers = @{Authorization = "Bearer $Accesstoken"}

$SignInData = (Invoke-RestMethod -Uri $URI -Headers $Headers -Method Get -ContentType "application/json") 

switch($UserType){

"guest"{$SignInDatareport = $SignInData.value | where{$_.userType -eq 'Guest'}}

"member"{$SignInDatareport = $SignInData.value | where{$_.userType -eq 'member'}}

"All"{$SignInDatareport = $SignInData.value }

}

Write-Log -message "Fetched user sign-in data" -path $log

$pagecount = 1

##########generate report############

$Report = [System.Collections.Generic.List[Object]]::new() 

Foreach ($User in $SignInDatareport) {

    If ($Null -ne $User.SignInActivity.lastSignInDateTime){$LastSignInDateTime = [DateTime]$User.SignInActivity.LastSignInDateTime}

    else{$LastSignInDateTime = "" }

    if($Null -ne $User.SignInActivity.LastNonInteractiveSignInDateTime){$LastNonInteractiveSignInDateTime = [DateTime]$User.SignInActivity.LastNonInteractiveSignInDateTime}

    else{$LastNonInteractiveSignInDateTime = ""}    

    $ReportLine  = [PSCustomObject] @{          

      UPN                = $User.UserPrincipalName

      DisplayName        = $User.DisplayName

      Email              = $User.Mail

      Id                 = $User.Id

      Created            = [DateTime]$User.CreatedDateTime  

      LastSignInDateTime = $LastSignInDateTime

      LastNonInteractiveSignInDateTime = $LastNonInteractiveSignInDateTime

      UserType           = $User.UserType 

      IsLicensed  = if ($User.assignedLicenses.Count -ne 0) { $true } else { $false } }

      $Report.Add($ReportLine) 

 } # End ForEach

 # Go to next page to fetch more data

 $NextLink = $SignInData.'@Odata.NextLink'

 While ($NextLink -ne $Null) { # We do... so process them.

    $pagecount = $pagecount + 1

    Write-log -message "Processing Page - $pagecount" -path $log

    $SignInData =  Invoke-RestMethod -Uri $NextLink -Headers $Headers -Method Get -ContentType "application/json"

    switch($UserType){

      "guest"{$SignInDatareport = $SignInData.value | where{$_.userType -eq 'Guest'}}

      "member"{$SignInDatareport = $SignInData.value | where{$_.userType -eq 'member'}}

      "All"{$SignInDatareport = $SignInData.value}

      }

Foreach ($User in $SignInDatareport) {  

    If ($Null -ne $User.SignInActivity.lastSignInDateTime){$LastSignInDateTime = [DateTime]$User.SignInActivity.LastSignInDateTime}

    else{$LastSignInDateTime = "" }

    if($Null -ne $User.SignInActivity.LastNonInteractiveSignInDateTime){$LastNonInteractiveSignInDateTime = [DateTime]$User.SignInActivity.LastNonInteractiveSignInDateTime}

    else{$LastNonInteractiveSignInDateTime = ""}   

    $ReportLine  = [PSCustomObject] @{          

      UPN                = $User.UserPrincipalName

      DisplayName        = $User.DisplayName

      Email              = $User.Mail

      Id                 = $User.Id

      Created            = [DateTime]$User.CreatedDateTime  

      LastSignInDateTime = $LastSignInDateTime

      LastNonInteractiveSignInDateTime = $LastNonInteractiveSignInDateTime

      UserType           = $User.UserType

      IsLicensed  = if ($User.assignedLicenses.Count -ne 0) { $true } else { $false } } 

      $Report.Add($ReportLine) }

    # Check for more data

    $NextLink = $SignInData.'@Odata.NextLink'

 } # End While

Write-log -message "All pages processed - export report - $($Report.count)" -path $log

###############################process last login data##########################################

$ReportCreatedpast90days = $Report | where{$(get-date $_.Created)  -lt (get-date).AddDays(-$DaysSinceLastLogin)}

[System.Collections.ArrayList]$collection = @() 

foreach($i in $ReportCreatedpast90days){

  $mcoll = "" | Select-Object UPN,DisplayName,Email ,Id ,Created ,LastSignInDateTime,LastNonInteractiveSignInDateTime, UserType ,IsLicensed, Status

  $mcoll.UPN = $i.UPN

  $mcoll.DisplayName = $i.DisplayName

  $mcoll.Email = $i.Email

  $mcoll.Id = $i.Id

  $mcoll.Created = $i.Created

  $mcoll.UserType = $i.UserType

  $mcoll.IsLicensed = $i.IsLicensed

  if($i.LastSignInDateTime -eq "" -and $i.LastNonInteractiveSignInDateTime -eq ""){

  $mcoll.LastSignInDateTime = $i.LastSignInDateTime

  $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

  $mcoll.status = "NullData"

  }

  elseif($i.LastSignInDateTime -eq "" -and $i.LastNonInteractiveSignInDateTime -ne ""){

  if($(get-date $i.LastNonInteractiveSignInDateTime) -lt (get-date).AddDays(-$DaysSinceLastLogin)){

  $mcoll.LastSignInDateTime = $i.LastSignInDateTime

  $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

  $mcoll.status = "Deactivate"

  }else{

    $mcoll.LastSignInDateTime = $i.LastSignInDateTime

    $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

    $mcoll.status = "NoAction"

  }

  }

  elseif($i.LastSignInDateTime -ne "" -and $i.LastNonInteractiveSignInDateTime -eq ""){

    if($(get-date $i.LastSignInDateTime) -lt (get-date).AddDays(-$DaysSinceLastLogin)){

  $mcoll.LastSignInDateTime = $i.LastSignInDateTime

  $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

  $mcoll.status = "Deactivate"

  }else{

    $mcoll.LastSignInDateTime = $i.LastSignInDateTime

    $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

    $mcoll.status = "NoAction"

  }

  }

  else{

  if($(get-date $i.LastSignInDateTime) -gt $(get-date $i.LastNonInteractiveSignInDateTime)){

  if($(get-date $i.LastSignInDateTime) -lt (get-date).AddDays(-$DaysSinceLastLogin)){

  $mcoll.LastSignInDateTime = $i.LastSignInDateTime

  $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

  $mcoll.status = "Deactivate"

  }else{

    $mcoll.LastSignInDateTime = $i.LastSignInDateTime

    $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

    $mcoll.status = "NoAction"

  }

  }

  else{

    if($(get-date $i.LastNonInteractiveSignInDateTime) -lt (get-date).AddDays(-$DaysSinceLastLogin)){

  $mcoll.LastSignInDateTime = $i.LastSignInDateTime

  $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

  $mcoll.status = "Deactivate"

  }else{

    $mcoll.LastSignInDateTime = $i.LastSignInDateTime

    $mcoll.LastNonInteractiveSignInDateTime = $i.LastNonInteractiveSignInDateTime

    $mcoll.status = "NoAction"

  }

  }

  }

  $collection.Add($mcoll)

}

###########################Exatract reports#################################

$collection | export-csv $ReportFull -NoTypeInformation

$deletecollection = $collection | Where{$_.Status -eq 'Deactivate' -or $_.Status -eq 'NullData'} 

$deletecollection | export-csv $ReportActual -NoTypeInformation

if($error){

  Write-Log -message "Error - $error" -path $log

  Send-MailMessage -SmtpServer $smtpserver -From $from -To $erroremail -Subject "Error Guest Deletion will not occur AzureADLastLoginReport" -Body $error[0].ToString()

  exit

}

Set-Recyclelogs -foldername "logs" -limit $logrecyclelimit -confirm:$false

Set-Recyclelogs -foldername "Report" -limit $logrecyclelimit -confirm:$false

Write-Log -Message "Script Finished" -path $log

#############################completed####################################