Last Logon Time in Office 365
Reading Time: < 1 minute
You may think the “LastLogonTime” is the real value where a user accessed their mailbox. It’s not and it can be modified by background processes (mailbox assistant).
The real answer is “LastUserActionTime”. This is an actual action that a user takes in the mailbox. It may be +/-2 days behind but is the best indicator a person is in the mailbox.
Commands you’ll need to get the LastLogonTime LastUserActionTime will be executed in PowerShell.
You’ll need to follow one of Microsoft’s ways of connecting to Exchange Online.
Then, once connected, use this one liner:
Get-MailboxStatistics -Identity [[email protected]] | select-object last*
