Why Office 365 Users’ Last Logon Time Reported by Get-MailboxStatistics is inaccurate?

As I was seeing a lot of feedback in my blog Export Office 365 users’ last logon time to CSV , regarding ‘How the script can produce recent last logon time even when the user blocked or disabled few months ago?’, I’ve decided to do some research with Get-MailboxStatistics cmdlet and posted a new updated version – Export Office 365 Users Real Last Activity Time(Real LastLogonTime) Report.

This blog post is going to give you some insight on how you can use Get-MailboxStatistics cmdlet to get Office 365 users’ inactive days.

That’s probably the question I get the most, but it’s perfect and therefore worth blogging about. Most people use LastLogonTime to identify user’s inactivity. LastLogonTime also gives the last time a background processes like Mailbox Assistant has accessed the mailbox. As LastLogonTime also updated by background tasks, we should go for some other attribute which shows the last time a ‘real’ user accessed the mailbox.

There are several attributes available in Get-MailboxStatistics, but I want to highlight is attributes related to the user’s activity.

Following are the attributes that related to user activity:

• LastEmailTime*
• LastContactsTime*
• LastCalendarTime*
• LastTasksTime*
• LastProfileTime*
• LastModernGroupsTime*
• LastInteractionTime
• LastLoggedOnUserAccount
• LastLogOffTime
• LastLogonTime
• LastUserAccessTime
• LastUserActionTime
• LastUserActionUpdateTime*
• LastUserActionWorkLoadAggregateTime*

But the Microsoft has not given any documentation about those attributes’ functionality. So I decided to play with those attributes and found following interesting things.

The research was done on many real-time users, and we have concluded that getting Office 365 user’s inactive time from LastUserActionTime is the best.

*Update 07/02/2019: We have noticed that several attributes such as LastEmailTime, LastUserActionUpdateTime, etc which were available earlier are not available now. From the above list, only the LastUserActionTime, LastUserAccesTime, LastInteractionTime, LastLoggedOnUserAccount, LastLogonTime and LastLogoffTime properties are available now.

LastEmailTime:

This attribute gets updated while accessing mailbox. Even when the user is not using their mailbox, LastEmailTime gets updated when the user receives a new mail.

LastContactTime:

When a user adds or removes a contact, LastContactTime value gets updated. Even when the user has not performed any contact related actions, the value gets updated. Similar behavior occurs in LastCalendarTime, LastTasksTime, and LastProfileTime.

For e.g., below user logged into his mailbox alone. Other than login, no action performed by the user but most of the attributes got updated.

So, I guess these values are getting updated based on some background tasks also.

LastInteractionTime:

LastInteractionTime gets updated independently of other attributes. It gets updated when the mailbox has interactions like login to the mailbox, receiving a new mail or reading an email. Unfortunately, it gets updated even when a background mailbox assistant accesses the mailbox. The value gets updated in real time.

The following mailbox was created for testing purpose and has not performed any actions (User not even logged in to mailbox), but all the attributes we have seen so far are getting updated.

That’s why we shouldn’t trust any of these above attributes to determine the user’s activity.

LastLogonTime:

Most people use LastLogonTime to retrieve inactive users list, which leads to inaccurate data. LastLogonTime does not reflect when the user logged in to mailbox alone, but also when a process like mailbox assistant accesses the mailbox. The same applies to LastLogOffTime. These two attributes get updated in real time.

LastModernGroupsTime:

LastModernGroupsTime gets populated only for Office 365 group mailboxes. Some background tasks also update this. Hence, the exact reason for this attribute remains unknown.

LastUserActionWorkLoadAggregateTime:

LastUserActionWorkLoadAggregateTime gets updated by comparing all workloads like LastEmailTime, LastContactsTime, LastCalendarTime, LastTaskTime, LastProfileTime, and LastModernGroupTime and shows the most recent time. As these basic attributes are getting updated by background tasks also, this attribute won’t be reliable for getting inactive users.

LastUserActionUpdateTime:

This attribute doesn’t indicate the user’s action. That being said, some attributes alone get updated in real time, remaining attributes get updated in a certain interval.

LastUserActionUpdateTime shows when the mailbox was last accessed to get the value for non-real time attributes like LastEmailTime, LastContactsTime, LastCalendarTime, LastTaskTime, LastProfileTime, LastModernGroupTime, and LastUserActionTime. So, you couldn’t see any non-real time attributes value later than this value. It’s like a schedule time to retrieve non-real time attributes value.

LastUserAccessTime and LastLoggedOnUserAccount value are empty for all object when I checked in my tenant.

LastUserActionTime:

Finally, LastUserActionTime. As the name implies, LastUserActionTime gets updated based on the user’s real actions. This attribute includes all user actions like login to the mailbox, when sending mail, and when reading a mail, etc. Unlike other attributes, its value will not be updated by a background task or process.

So, user’s inactivity can be retrieved from LastUserActionTime.

LastUserActionTime doesn’t show up-to-date data. There will be some delay like a day or two. You can refer LastUserActionUpdateTime which indicates when the LastUserActionTime was updated.

Getting inactive mailboxes is the most needed task as it involves regaining unused licenses, archiving mailboxes, etc. Hence, the attribute used to get inactive mailbox must be more accurate. From the research, we found that getting inactive mailboxes using LastUserActionTime is the best solution.

As of now, Microsoft has not given any proper documentation for these attributes. Microsoft really amazes me sometimes on how they make the easiest thing so hard to find. I believe these attributes have more hidden features that will make admins’ work more simple. I hope there will be an update from Microsoft soon.

• If you want to list Office 365 inactive mailboxes based on user’s LastUserActionTime, you can refer our blog post to Export Office 365 user last activity time report.
• You can also use the Get-MgUser cmdlet to retrieve Office 365 users’ last interactive and non-interactive sign in activity.

Hopefully, this blog can help you to resolve your issue! What do you think? Is this a solution you’d like to work with? or do you use any other methods to get users’ inactivity time? Please share your thoughts through the comment section.