Microsoft Entra ID

How to Find All Users Sign-Ins with Device Details in Microsoft 365

Are users signing in to Microsoft 365 from multiple devices, personal laptops, managed desktops, mobile phones, or shared workstations? Without proper visibility into these sign-ins, admins may face security blind spots, compliance risks, and unauthorized access. This guide shows how to retrieve all users’ sign-ins with device details to enable stronger access control and improve device compliance.

Monitor User Sign-Ins with Device Details Using the Entra Admin Center

Microsoft 365 Permission Required

Report Reader Least Privilege

Global Administrator Most Privilege

Log in to the Microsoft Entra admin center.
Navigate to the Entra ID» Monitoring & health» Sign-in logs. Then, select the specific sign-in and switch to the Device info tab to view the device details.
This includes information such as device ID, browser, operating system, compliance status, managed status, and join type.

Monitor User Sign-Ins with Device Details Using the Entra Admin Center

Note: In the Entra admin center, you need to check each sign-in individually to view its device details.

Audit Entra User Sign-Ins Log with Device Information Using PowerShell

Microsoft 365 Permission Required

AuditLog.Read.All, Directory.Read.All Least Privilege

Directory.ReadWrite.All Most Privilege

Use the following cmdlet to connect to Microsoft Graph PowerShell with at least the Report Reader role.

Windows PowerShell

 Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"

Execute the PowerShell cmdlet below to list all user sign-ins with their device details.

Windows PowerShell

 Get-MgBetaAuditLogSignIn -top 30 |
   Select-Object userDisplayName, userPrincipalName, createdDateTime,
     clientAppUsed, ipAddress,
     @{n='DeviceID';   e={$_.deviceDetail.DeviceId}},
     @{n='Devicename';   e={$_.deviceDetail.Displayname}},
     @{n='OS';         e={$_.deviceDetail.operatingSystem}},
     @{n='Browser';    e={$_.deviceDetail.browser}},
     @{n='IsManaged';  e={$_.deviceDetail.isManaged}},
     @{n='IsCompliant';e={$_.deviceDetail.isCompliant}}|format-table -autosize

The execution of the script displays all Microsoft 365 user sign-ins along with device details, such as device ID, device name, operating system, browser, managed status, and compliance status.

Audit Entra User Sign-Ins Log with Device Information Using PowerShell

Get All User Sign-Ins with Device Info Using PowerShell Script

Microsoft 365 Permission Required

Report Reader Least Privilege

Global Administrator Most Privilege

While PowerShell can retrieve user sign-ins along with device information, the process is time-consuming and requires multiple filters.
To simplify this, we have developed a script that exports Entra ID sign-in activity with device details.
Download and run the script to generate users' sign-ins with device details report that includes device name, UPN, OS, and more.

Get All User Sign-Ins with Device Info Using PowerShell Script

GetEntraSigninLogs.ps1

Simple & Quick
Export M365 User Sign-In Logs with Device Info Using AdminDroid

AdminDroid Permission Required Delegated

Any user with report access delegated by the Super Admin.

Log in to AdminDroid 365 Portal.
Navigate to the All User Sign-Ins with Device Details report under Reports»Entra»Analytics»Sign-in Analytics»Sign-Ins»Device Analytics»Sign-Ins with Device Details.
This report provides detailed insights into all user sign-ins with device details, such as signed-in time, signed-in user, signed-in application name, device display name, device trust type, OS version, device browser, and more.

Export M365 User Sign-In Logs with Device Info Using AdminDroid

Additionally, you can export all user sign-ins with device details report using the download option in various formats like CSV, PDF, HTML, and more.

AdminDroid Microsoft 365 Sign-in Analytics

Gain Insights into M365 Device-Based Sign-Ins to Strengthen Identity Protection

AdminDroid’s Microsoft 365 sign-in analytics tool offers detailed reports on sign-ins based on last login, device details, risky sign-ins, and more. This helps to effectively monitor users' sign-in attempts without relying on complicated PowerShell scripts.

List Entra Devices with Last Sign-In Details for Security Review

Identify all Entra registered devices along with their last sign-in details to support security investigations and manage devices effectively.

Track Mobile Device User Sign-Ins in Entra ID

Identify mobile user sign-in logs to find users accessing Microsoft 365 from smartphones and tablets to improve endpoint visibility and enforce mobile access policies.

Identify Non-Compliant Device Sign-Ins in Microsoft 365

Monitor user sign-ins via non-compliant devices, such as those lacking encryption or updated configurations, to enforce stronger compliance controls.

Analyze Most Used Sign-In Devices in Entra ID to Improve Security

View user sign-in summary with devices to find the most frequently used ones and apply endpoint protection, like regular updates, disk encryption, etc, to help block malware and credential-stealing attacks.

Stay Informed About Blocked Sign-Ins in M365 with Device Insights

Receive instant alerts when a disabled user attempts to sign-in and review the device and location details to spot suspicious login attempts in Microsoft 365.

Remove Unmanaged Device Sign-Ins to Strengthen Endpoint Control

Detect users sign-ins from unmanaged devices to ensure only trusted devices can access resources in your Microsoft 365 organization.

Overall, AdminDroid strengthens Microsoft 365 security with actionable insights on user sign-ins, device compliance, and MFA usage. With these insights, you can quickly detect and respond to suspicious activity across your entire organization.

Explore a full range of reporting options

Download Live Demo

Important tips

Reset unused Intune device management permissions in Entra admin center if you are unable to add devices or face failures during sign-ins.

Set up a break-glass app in Entra ID to regain admin access when trusted devices are lost, stolen, or blocked by Conditional Access policies.

Block jailbroken or rooted devices that bypass built-in security controls in Microsoft 365 to prevent serious security breaches.

Common Errors and Resolution Steps

Below are common errors and troubleshooting steps that may occur while identifying users' sign-ins with device details.

Error Get-MgBetaAuditLogSignIn: The term ‘Get-MgBetaAuditLogSignIn’ is not recognized as a name of a cmdlet, function, script file, or executable program.

This error occurs while executing the 'Get-MgBetaAuditLogSignIn' cmdlet in PowerShell without the Microsoft.graph.beta module installed.

Fix Execute the PowerShell cmdlet below to install the Microsoft.graph.beta module.

Install-Module -Name Microsoft.Graph.Beta

Error Get-MgBetaAuditLogSignIn_list: Authentication needed. Please call Connect-MgGraph.

This error occurs when the ‘Get-MgBetaAuditLogSignIn’ cmdlet is executed without connecting to the Microsoft Graph PowerShell module.

Fix Make sure you have connected to the Microsoft Graph PowerShell module by using the cmdlet below.

Connect-MgGraph

Error Get-MgBetaAuditLogSignIn_list: User is not in the allowed roles.

This error occurs when you try to access Entra ID sign-in logs without the necessary admin permission.

Fix Please ensure that you possess one of the necessary administrative permissions listed below.

Global Administrator, Security Admin, Security Reader, Global Reader, or Reports Reader.

Error Get-MgBetaAuditLogSignIn_List: Calling principal does not have required MSGraph permissions AuditLog.Read.All.

This error occurs when the ‘Get-MgBetaAuditLogSignIn’ cmdlet is executed without AuditLog.Read.All permissions.

Fix Make sure you have connected to the Microsoft Graph PowerShell module with the required permissions by using the cmdlet below.

Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"

Error ./GetEntraSigninLogs.ps1: File C:\Users\pc\Downloads\GetEntraSigninLogs.ps1 cannot be loaded. The file C:\Users\pc\Downloads\GetEntraSigninLogs.ps1 is not digitally signed. You cannot run this script on the current system.

This error occurs when Windows PowerShell blocks the execution of the script due to security restrictions. It usually happens when the file is downloaded from the internet or when the execution policy is set to be restrictive.

Fix To resolve the error, run the cmdlet below.

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

Microsoft Entra ID

Frequently Asked Questions

Monitor and Secure Microsoft Entra ID Sign-Ins with Detailed Device Insights!

How to find Microsoft 365 user sign-in logs for a specific device?

How to apply Conditional Access policies to restrict sign-ins from a specific device?

How to find stale devices in Microsoft Entra ID based on last sign-in activity?

How to enforce MFA and allow sign-ins only from trusted devices in Entra ID?

How to remove non-compliant devices used for sign-ins in Microsoft Intune?

1. How to find Microsoft 365 user sign-in logs for a specific device?

Imagine the security team discovers sign-ins from a device previously assigned to an offboarded employee. To assess this potential unauthorized access, they need to track all sign-ins from that specific device. Since sign-ins can’t be directly filtered by device in Intune or Entra ID, you can use Microsoft Graph PowerShell to monitor device-based sign-in activity.

Monitor Microsoft 365 user sign-in details from a specific device

Use the following cmdlet to connect to Microsoft Graph PowerShell with at least the Report Reader role.
```
Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"
```

Execute the PowerShell cmdlet below to list all user sign-in logs for a specific device.

$deviceName = "<DeviceName>"
Get-MgBetaAuditLogSignIn -Top 1000 | Where-Object { $_.deviceDetail.displayName -eq  $deviceName } | Select-Object userDisplayName, userPrincipalName, createdDateTime, clientAppUsed, ipAddress, 
@{n='DeviceID';   e={$_.deviceDetail.DeviceId}}, 
@{n='Devicename'; e={$_.deviceDetail.Displayname}},
@{n='OS';         e={$_.deviceDetail.operatingSystem}}, 
@{n='Browser';    e={$_.deviceDetail.browser}}, 
@{n='IsManaged';  e={$_.deviceDetail.isManaged}}, 
@{n='IsCompliant';e={$_.deviceDetail.isCompliant}} | Format-Table -AutoSize

sign-in-from-specific-device-using-powershell

Replace the <DeviceName> with the respective device name to get all the logins for the specific device with details, such as UPN, time, device ID, OS, browser, managed status, and compliance status.

Get instant alerts for users’ sign-in logs in a specific device with just a few clicks using AdminDroid!

Easily set up alerts and filter sign-ins by specific devices using AdminDroid’s all users' sign-ins with device details insights. You can monitor device-specific sign-in trends, receive alerts for unusual activity, and generate detailed reports for audits.

get-alert-sign-ins-from-device-using-admindroid

Handy Tip: Utilize the Threshold property when creating the alert policy to get notified when a specific number of sign-ins from devices occurs within a short timeframe.

2. How to apply Conditional Access policies to restrict sign-ins from a specific device?

When a device is lost, hacked, or doesn't follow your organization's security rules, sign-ins from that device can put your data at risk. To prevent this, admins should apply Conditional Access policies that block user sign-ins from those devices. This ensures only trusted devices can access Microsoft 365 resources and keeps your environment secure.

Create a Conditional Access policy to restrict the sign-ins from a specific device

Log in to the Microsoft Entra admin center.
Navigate to ID Protection»Risk-based Conditional Access» Policies, and click + New policy.
Give a unique name to your policy. In the Users section, specify the users to be a part of this policy, or include all users. Under Target resources, select All cloud apps.
In the Conditions section, go to Filters for devices and set Configure to Yes. Then, choose Include filtered devices in policy under Devices matching the rule.
Use device properties like Device ID, Operating System, or Join Type to define the specific device you want to restrict.
Under Grant, select Block access to prevent sign-in from the filtered devices.
Initially, set the policy mode to ‘Report-only’ to test without enforcement.
After verifying, switch the policy to On, and click Save to enforce the restriction.

3. How to find stale devices in Microsoft Entra ID based on last sign-in activity?

As your Microsoft 365 environment grows, more devices get registered, and some may eventually go unused or inactive. Instead of ignoring these unused devices, admins can review sign-ins to identify those with no recent activity. This helps clean up stale records, reduce clutter in reports, and streamline overall device management.

Track inactive devices using the Entra admin center

Log in to the Microsoft Entra admin center.
Navigate to Entra ID» Devices» All Devices.
Now you can see the last sign-in time of devices under the Activity column.
Based on the last sign-in activity, you can identify unused devices that haven’t signed in during the last 30 days.

stale-devices-based-on-last-sign-in-entra

In the Entra admin center, you must manually check the activity column each time to find inactive devices. PowerShell offers a simpler way to detect stale devices.

Check all Entra ID inactive devices using PowerShell

Connect to the Microsoft Graph PowerShell module with required permissions using the cmdlet below.
```
Connect-MgGraph -Scopes "Device.Read.All"
```

Execute the script below to find all unused devices with details, such as device name, device ID, OS, and last sign-in time.

$devices = Get-MgDevice -All
$devices | Where-Object { $_.ApproximateLastSignInDateTime -lt (Get-Date).AddDays(-30) } | Select-Object DisplayName, DeviceId, OperatingSystem, ApproximateLastSignInDateTime

stale-devices-by-last-activity-using-powershell

4. How to enforce MFA and allow sign-ins only from trusted devices in Entra ID?

When users attempt to sign in from personal laptops or unmanaged devices, these sign-ins are often considered risky and may be blocked. Instead of completely blocking access, admins can configure conditional access policies to require multi-factor authentication (MFA). This approach ensures that only trusted devices can seamlessly access Microsoft 365 resources, while untrusted devices are challenged with additional verification.

Restrict users' sign-ins from the unmanaged devices using CA policies

Log in to the Microsoft Entra admin center.
Navigate to ID Protection» Conditional Access» Policies, and click + New policy.
Give a unique name to your policy. In the Users section, specify the users to be a part of this policy, or include all users. Under Target resources, select All cloud apps.
In the Conditions section, first set the sign-in risk by selecting all three risk levels: High, Medium, and Low.
Then, go to Filter for devices and set Configure to Yes.
Now choose Include filtered devices in policy under Devices matching the rule.
Choose device properties like IsCompliant not equal to true and Trust Type not equal to Entra Registered, Entra Hybrid Joined, Entra Joined as conditions and click Done.
Under Grant, select Grant access to sign in from the filtered devices based on the conditions with required MFA.
Initially, set the policy mode to ‘Report-only’ to test without enforcement.
After verifying, switch the policy to On, and click Save to enforce the restriction.

restrict-access-from-risky-devices-by-device-filters

restrict-access-from-risky-devices-by-mfa

5. How to remove non-compliant devices used for sign-ins in Microsoft Intune?

Over time, some devices used for Microsoft 365 sign-ins may fall out of compliance due to missing security updates, MDM issues, or changes in configuration. Non-compliant devices may continue to access Microsoft services unless they're removed or blocked. To maintain a secure environment, it’s important for admins to regularly review and remove such devices to ensure only healthy, trusted endpoints are allowed for sign-ins.

Remove non-compliant devices used for sign-ins using the Intune admin center

Log in to the Microsoft Intune admin center.
Navigate to Devices» All Devices.
Apply a filter by setting Compliance = Noncompliant to display all non-compliant devices.
Select the device from the filtered list that you want to remove.
Click ‘Delete’ to remove the device from your organization.

Note: You can also remove/block non-compliant devices from the Microsoft Entra admin center.

How to Find All Users Sign-Ins with Device Details in Microsoft 365

Monitor User Sign-Ins with Device Details Using the Entra Admin Center

Audit Entra User Sign-Ins Log with Device Information Using PowerShell

Get All User Sign-Ins with Device Info Using PowerShell Script

Simple & Quick Export M365 User Sign-In Logs with Device Info Using AdminDroid

Gain Insights into M365 Device-Based Sign-Ins to Strengthen Identity Protection

List Entra Devices with Last Sign-In Details for Security Review

Track Mobile Device User Sign-Ins in Entra ID

Identify Non-Compliant Device Sign-Ins in Microsoft 365

Analyze Most Used Sign-In Devices in Entra ID to Improve Security

Stay Informed About Blocked Sign-Ins in M365 with Device Insights

Remove Unmanaged Device Sign-Ins to Strengthen Endpoint Control

Important tips

Reset unused Intune device management permissions in Entra admin center if you are unable to add devices or face failures during sign-ins.

Set up a break-glass app in Entra ID to regain admin access when trusted devices are lost, stolen, or blocked by Conditional Access policies.

Block jailbroken or rooted devices that bypass built-in security controls in Microsoft 365 to prevent serious security breaches.

Common Errors and Resolution Steps

Error Get-MgBetaAuditLogSignIn: The term ‘Get-MgBetaAuditLogSignIn’ is not recognized as a name of a cmdlet, function, script file, or executable program.

Error Get-MgBetaAuditLogSignIn_list: Authentication needed. Please call Connect-MgGraph.

Error Get-MgBetaAuditLogSignIn_list: User is not in the allowed roles.

Error Get-MgBetaAuditLogSignIn_List: Calling principal does not have required MSGraph permissions AuditLog.Read.All.

Error ./GetEntraSigninLogs.ps1: File C:\Users\pc\Downloads\GetEntraSigninLogs.ps1 cannot be loaded. The file C:\Users\pc\Downloads\GetEntraSigninLogs.ps1 is not digitally signed. You cannot run this script on the current system.

Monitor and Secure Microsoft Entra ID Sign-Ins with Detailed Device Insights!

1. How to find Microsoft 365 user sign-in logs for a specific device?

Monitor Microsoft 365 user sign-in details from a specific device

2. How to apply Conditional Access policies to restrict sign-ins from a specific device?

Create a Conditional Access policy to restrict the sign-ins from a specific device

3. How to find stale devices in Microsoft Entra ID based on last sign-in activity?

Track inactive devices using the Entra admin center

Check all Entra ID inactive devices using PowerShell

4. How to enforce MFA and allow sign-ins only from trusted devices in Entra ID?

Restrict users' sign-ins from the unmanaged devices using CA policies

5. How to remove non-compliant devices used for sign-ins in Microsoft Intune?

Remove non-compliant devices used for sign-ins using the Intune admin center

Kickstart Your Journey With AdminDroid

Simple & Quick
Export M365 User Sign-In Logs with Device Info Using AdminDroid

Kickstart Your Journey With
AdminDroid