Customer Engagement & Dynamics CRM Forum

Just to add to this, at some point a while back, Read Auditing came out which started pushing stuff to the Security and Compliance Centre. One of the things it should be collecting is 'Signed in or Out'.

https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/admin/enable-use-comprehensive-auditing ​

I was testing this at the time and while I was able to export some stuff, a lot of the switches didnt really work and the export was a mess with a lot of the useful stuff unfilterable.
I have no idea whether this has changed at all in the months since but its possibly worth looking at to see what can be done with it now.

Jamie

Just to add to this, at some point a while back, Read Auditing came out which started pushing stuff to the Security and Compliance Centre. One of the things it should be collecting is 'Signed in or Out'.

https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/admin/enable-use-comprehensive-auditing ​

I was testing this at the time and while I was able to export some stuff, a lot of the switches didnt really work and the export was a mess with a lot of the useful stuff unfilterable.
I have no idea whether this has changed at all in the months since but its possibly worth looking at to see what can be done with it now.

Jamie

Just to add to this, at some point a while back, Read Auditing came out which started pushing stuff to the Security and Compliance Centre. One of the things it should be collecting is 'Signed in or Out'.

https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/admin/enable-use-comprehensive-auditing ​

I was testing this at the time and while I was able to export some stuff, a lot of the switches didnt really work and the export was a mess with a lot of the useful stuff unfilterable.
I have no idea whether this has changed at all in the months since but its possibly worth looking at to see what can be done with it now.

Jamie

Just to add to this, at some point a while back, Read Auditing came out which started pushing stuff to the Security and Compliance Centre. One of the things it should be collecting is 'Signed in or Out'.

https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/admin/enable-use-comprehensive-auditing ​

I was testing this at the time and while I was able to export some stuff, a lot of the switches didnt really work and the export was a mess with a lot of the useful stuff unfilterable.
I have no idea whether this has changed at all in the months since but its possibly worth looking at to see what can be done with it now.

Jamie

<fetch version="1.0" output-format="xml-platform" mapping="logical" distinct="true" aggregate="true" no-lock="false" >

    <entity name="audit" >

        <attribute name="createdon" alias="lastlogon" aggregate="max" />

        <attribute name="action" groupby="true" alias="actionid" />

        <attribute name="userid" groupby="true" alias="name" />

        <filter type="and" >

            <condition attribute="action" operator="eq" value="64" />

            <condition attribute="createdon" operator="on-or-after" value="2019-09-01" />

        </filter>

        <link-entity name="systemuser" from="systemuserid" to="objectid" link-type="outer" alias="SystemUser" >

            <attribute name="fullname" groupby="true" alias="fullname" />

            <attribute name="isdisabled" groupby="true" alias="isdisable" />

            <filter type="and" >

                <condition attribute="isdisabled" operator="eq" value="0" />

            </filter>

        </link-entity>

    </entity>

</fetch>

<fetch version="1.0" output-format="xml-platform" mapping="logical" distinct="true" aggregate="true" no-lock="false" >

    <entity name="audit" >

        <attribute name="createdon" alias="lastlogon" aggregate="max" />

        <attribute name="action" groupby="true" alias="actionid" />

        <attribute name="userid" groupby="true" alias="name" />

        <filter type="and" >

            <condition attribute="action" operator="eq" value="64" />

            <condition attribute="createdon" operator="on-or-after" value="2019-09-01" />

        </filter>

        <link-entity name="systemuser" from="systemuserid" to="objectid" link-type="outer" alias="SystemUser" >

            <attribute name="fullname" groupby="true" alias="fullname" />

            <attribute name="isdisabled" groupby="true" alias="isdisable" />

            <filter type="and" >

                <condition attribute="isdisabled" operator="eq" value="0" />

            </filter>

        </link-entity>

    </entity>

</fetch>

<fetch version="1.0" output-format="xml-platform" mapping="logical" distinct="true" aggregate="true" no-lock="false" >

    <entity name="audit" >

        <attribute name="createdon" alias="lastlogon" aggregate="max" />

        <attribute name="action" groupby="true" alias="actionid" />

        <attribute name="userid" groupby="true" alias="name" />

        <filter type="and" >

            <condition attribute="action" operator="eq" value="64" />

            <condition attribute="createdon" operator="on-or-after" value="2019-09-01" />

        </filter>

        <link-entity name="systemuser" from="systemuserid" to="objectid" link-type="outer" alias="SystemUser" >

            <attribute name="fullname" groupby="true" alias="fullname" />

            <attribute name="isdisabled" groupby="true" alias="isdisable" />

            <filter type="and" >

                <condition attribute="isdisabled" operator="eq" value="0" />

            </filter>

        </link-entity>

    </entity>

</fetch>