What is the best way of establishing the last logon when a user account has both a AD and AzureAD user account?

Question

I am unsure how to deal with this because of how Adaxes treats one identity account as two different objects, an AD and AzureAD user account, and both has different last logon values.

What is a good way to combine the data?

Comments

Hello Daniel,

The behavior has nothing to do with Adaxes. It comes from Microsoft. First of all, Entra (former Azure AD) accounts do not have the Last Logon property at all. Both the on-premises accounts and Entra accounts have the Last Logon Timestamp property. However, it is not replicated and the behavior is by design. Pay attention that there is also Exchange Online login and that it a totally different story. For us to suggest a solution, please, describe the desired workflow in all the possible details with live examples.

---

I have the same question, I assume that Daniel's requirement is similar to mine.

I want to be able to select users that have an older than xx AD lastlogon time stamp AND also have an older than yy Azure last logon time stamp / last authenticated / last activity time stamp so that users that have not been authenticated by the AD domain but are active in Azure are not false positives for inactivity who mistakenly get their AD account disabled and lose access to resources unnecessarily.

---

Hello,

Sorry for the confusion, but we are not sure what exactly you mean by select users here. Do you need a report containing only the users that have both dates older than a specific period? Also, please, specify whether you have your Entra domain (not Microsoft 365 tenant) registered in Adaxes (will be displayed under the Managed domains node).

---

I have a scheduled task that moves, strips group memberships from and disables users when their last login timestamp is more than 5 weeks ago.

I don't want users that are actively using their account in Azure to be caught by this task. I want to add an exception for those user accounts that have recent authentications in Azure.

The current scheduled task catches users that do not have a recent domain last login timestamp. In those cases those users have generally been authenticated by Entra and are actively present in Azure / M365 logs as being active.

Am I over thinking this?

I have a task which mainly does what I need. An unwanted impact is inconveniencing users that are able to connect into our infrastructure and do their work without logging into AD. Until they unexpectedly get switched off.

Answer 1

Hello,

If you register your Entra domain in Adaxes, you can use the following script from our repository in the scheduled task condition: https://www.adaxes.com/script-repository/check-entra-account-last-logon-s692.htm.