View who has logged into Dynamics 365 - across many environments
A licencing requirement was raised at work this week where we needed to know who out of our Dynamics 365 CRM users were actually using the application. These licences are really expensive and having many of them unused would cost the company lots of money over the year.
We did think of looking at audit tables in CRM, but unfortunately this wasn't an option due to the fact we have many Dynamics 365 environments. A single licence will allow you access (if you have permission) to access as many sandbox environments as you wish. This would mean collating data from many environments into one dataset.
We needed something more overarching.
So I reviewed Azure AD to see if I could view signins for a particular application and low and behold I could see all logins to Dynamics CRM Online. All we would is visit this page, add the filters and download a CSV file. The resultant CSV file would then need filtering to remove duplicate users, because we don't care about when and how many times they have logged in, just the fact they have at least once in the time period.
This was a great resource and gave us the information we needed. Naturally, we wanted to take it further and to provide this programmatically with the least amount of user interaction as possible.
Enter Microsoft Azure AD Graph API
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api
This API allows developers to get access to all sorts of data within Azure AD including application signins.
The first step is to setup an application in Azure AD.
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api
Once this is complete, you should have an application ID, Access Key and your tenant name.
Next you can write a script to interact with the API. There are samples around and you can even use the Graph Explorer to play around against a dummy tenant
https://developer.microsoft.com/en-us/graph/graph-explorer
I found the following script which seemed like a good place to start.
https://gallery.technet.microsoft.com/scriptcenter/Pull-Azure-AD-Sign-In-3fead683
I then needed to filter it by application too. I did this by editing the following line
This then produces a CSV with all the signins to Dynamics CRM Online for the last 30 days, but seeing that we only care if someone as logged on at all, we only want to see one entry per user.
We added the following line at the bottom of the script which will reimport the CSV selecting only the UPN and then removing any lines which are not unique. It will then export this to a final csv output.
Here is the full script
We did think of looking at audit tables in CRM, but unfortunately this wasn't an option due to the fact we have many Dynamics 365 environments. A single licence will allow you access (if you have permission) to access as many sandbox environments as you wish. This would mean collating data from many environments into one dataset.
We needed something more overarching.
So I reviewed Azure AD to see if I could view signins for a particular application and low and behold I could see all logins to Dynamics CRM Online. All we would is visit this page, add the filters and download a CSV file. The resultant CSV file would then need filtering to remove duplicate users, because we don't care about when and how many times they have logged in, just the fact they have at least once in the time period.
This was a great resource and gave us the information we needed. Naturally, we wanted to take it further and to provide this programmatically with the least amount of user interaction as possible.
Enter Microsoft Azure AD Graph API
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api
This API allows developers to get access to all sorts of data within Azure AD including application signins.
The first step is to setup an application in Azure AD.
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api
Once this is complete, you should have an application ID, Access Key and your tenant name.
Next you can write a script to interact with the API. There are samples around and you can even use the Graph Explorer to play around against a dummy tenant
https://developer.microsoft.com/en-us/graph/graph-explorer
I found the following script which seemed like a good place to start.
https://gallery.technet.microsoft.com/scriptcenter/Pull-Azure-AD-Sign-In-3fead683
I then needed to filter it by application too. I did this by editing the following line
This then produces a CSV with all the signins to Dynamics CRM Online for the last 30 days, but seeing that we only care if someone as logged on at all, we only want to see one entry per user.
We added the following line at the bottom of the script which will reimport the CSV selecting only the UPN and then removing any lines which are not unique. It will then export this to a final csv output.
Here is the full script
Comments
Post a Comment