Getting a list of last logged on users for an Intune Device
Solving a common K-12 problem using the Microsoft Graph API!
Introduction
About a month ago, I had a situation come up at our High School where a student placed their laptop down and another student picked it up and had taken it to their next class by mistake. This is a surprisingly common occurrence in the K-12 space. Every time this issue comes up, I let out a groan as there isn’t a great way to figure out who has the device from Intune. For some reason, Intune has it to where you can get login logs for a user and figure out which devices a user has logged into, but there isn’t an easy way to get a list of users that have logged into a specific device. Until now…
The Script
I have created a script that leverages Microsoft Graph API to get a list of last logged on users on a given device along with time stamps. Pretty neat huh?
The script can be found using the link below to my GitHub.
GitHub - Intune-Device-User-Logins
Once you open the script, there are a couple of commands you will need to run to install the required modules that the script uses.
Install-Module Microsoft.Graph.Beta.Devicemanagement
Install-Module Microsoft.Graph.Beta.Users
Once they are installed and you run the script, it will ask you to authenticate to your Azure Tenant.
After you sign in, you will be asked to give the device’s hostname. Once you type that in and hit enter, it will give you the data.
Another tool in the box!
This script worked great and was exactly what i was looking for
Brady,
Thank you for the PowerShell script. I have added it to my tech arsenal. There is one other way I am aware of to get this info and it is the only reason we ever use the Intune Education Portal (https://intuneeducation.portal.azure.com/). Dashboard > Devices > select your device > Recent check-ins. There will be a drop down that lists each user that has logged into the device. Will be interesting to see if the results match the script output. Not sure why Microsoft does not appear to surface the Recent Check-ins option anywhere else that I can find.