Cli-microsoft365: New command: aad user signin list

[plamber]

Usage

aad user signin list [options]

Description

Retrieve the Azure AD user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.

Options

| Option | Description |
| ----------------------- | ----------------------------------------- |
| --user <user> | Filters the userId, userPrincipalName or DisplayName of a user |
| --app <app> | Filters the appId and appname |
| --isRisky <isRisky> | true|false filters risky or not risky requests |
| --before <before> | returns the values before a specific date |
| --after<after> | returns the values after a specific date |
| --filter <filter> | The filter parameters supported by the signing command |

Additional Information

https://docs.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-1.0&tabs=http

[plamber]

First of all I would like to understand together with you where we could place this command. It returns signin activities of a user. Therefore, it could be associated to some user command.

There are a lot of filter criterias available for this command. It will be quite difficult to provide all the options in a simple way. I think we should focus on few that might make sense. For example, we could combine userDisplayName, userId, and userPrincipalName in one parameter. Based on which values are passed already provide the necessary filters. I would do the same for appId, appDisplayName.

I find the createdDateTime interesting. We might consider having some commands that allow us to pass a daterange. Do we have examples that already do this?

I would also take out the isRisky parameter and provide a top parameter to limit the results.

If somebody wants to use something else, they can use the filter parameter and build their own query.

[waldekmastykarz]

First of all I would like to understand together with you where we could place this command. It returns signin activities of a user. Therefore, it could be associated to some user command.

To me, it seems like a perfect match for the aad namespace

There are a lot of filter criterias available for this command. It will be quite difficult to provide all the options in a simple way.

How about we start with UPN and userId and take it from there?

I find the createdDateTime interesting. We might consider having some commands that allow us to pass a daterange. Do we have examples that already do this?

Good idea! I don't think we have an example of that other than the range-based reports you've built.

I would also take out the isRisky parameter and provide a top parameter to limit the results.

Love it!

If somebody wants to use something else, they can use the filter parameter and build their own query.

This is definitely good approach for the start. We can always extend it in the future if we notice specific usecases.

[waldekmastykarz]

Updated the command name to singular to match our naming convention

[plamber]

@waldekmastykarz: what about this definition?

[waldekmastykarz]

Let's do it!

[plamber]

I can take it up if nobody else does

[waldekmastykarz]

You've got 4 commands in progress already. Shall we get them done first and see if someone else wants to pick this one? 🙂