Incorrect Last Logon/Sign-in

The Last Logon (or Last Sign-in) value shows the timestamp of the latest activity for a user account. Depending on the data source and your company’s settings, this date may vary.

In vScope, the tag Last Logon displays the most recent value found in a data source, such as Google Workspace, Microsoft Entra ID, or Active Directory. You may also find specific tags for each data source, such as Azure Last Sign In.

From Microsoft Entra ID

The value is recorded when a user successfully authenticates against Entra ID (Azure AD) using their credentials (username and password, passwordless method, or MFA).

In vScope, you can also configure it to fetch non-interactive logins—cases where a token refreshes without the user actively clicking a “Login button”.

If you don’t see a value, or if you suspect the value is incorrect:

1. Verify that you have added the correct permissions in the Azure connector.
2. Check if Sign-in events is enabled in Discovery > Credential > Azure.

Note

Enabling non-interactive sign-in events searches the event log and may slow down discovery, depending on the size of your network.

From Active Directory

If the last logon date in vScope doesn’t match the information in Active Directory (AD), follow these steps to troubleshoot:

1. Verify Domain Controller Inventory Make sure vScope is configured to inventory all domain controllers (DCs) in your environment. Missing data from one or more DCs may cause outdated or incomplete last logon information in vScope.

2. Compare Last Logon Timestamp with AD Run the following PowerShell command on a DC to retrieve the lastLogonTimestamp for all users in the specified search base. This helps confirm whether vScope’s data matches AD.

   Get-ADUser -Filter * -SearchBase 'CN=Users,DC=domain,DC=com,DC=au' -Properties Name,LastLogonTimestamp | Select Name,LastLogonTimestamp | Out-GridView

   Replace DC=domain,DC=com,DC=au with your domain details.

3. Check for Permission Issues Ensure that the credentials used by vScope have sufficient permissions to read the lastLogonTimestamp attribute. A lack of permissions can lead to missing or outdated information.

   For more details on permissions issues, see this Microsoft TechNet discussion.