Leveraging last interactive sign in data from Azure AD inside the Adaxes Management Console

Question

Hello there,

We have recently moved (almost) every computer from on-prem to cloud only and have setup some scheduled tasks to disable users based off of Last Logon and Last Logon Timestamp attributes inside Adaxes. If users are only signing into cloud apps though Adaxes doesn't register that sign in.

I have added our Azure AD as a managed domain in Adaxes hoping that it would give us access to that last login data that Azure has but I'm not seeing any Last Logon attributes at all for users under the Azure AD managed domain in Adaxes Console. Is this achievable in a different way? And if not, are there any plans to leverage that data?

Answer 1

Hello Jacob,

The thing is that logon information is stored separately for Entra accounts and for on-premises AD accounts. To check when a user last logged on to Entra, you can use the following script from our repository: https://www.adaxes.com/script-repository/check-entra-account-last-logon-s692.htm.

Comments

I was able to figure this out and implement it in Adaxes. You'll want to make sure you have these permissions in your enterprise application for Adaxes in Azure. They have to be Application, not Delegated.

Once this is done the last logon timestamp attribute appeared for the Azure users in Adaxes. We created a scheduled task that would scope to the Azure domain users OU, look for the on-prem synced attribute to be true (that way this won't inadvertently target cloud only users), check if account is enabled, check if last-logon-timestamp attribute is before %datetime, -1M% (you can adjust the length of time to your preference), and this one is optional but I added in a When Created attribute is before %datetime, -1M% just so it wouldn't target newhires.

For the action I just had it run a powershell script and did the following:

disable-adaccount -identity %onPremisesObjectGuid% -confirm:$false

Hope this helps!