How to get cloud account login / logout time details?

Use Microsoft Entra sign-in logs to get the user’s sign-in (login) times. These logs can be exported and then consumed from C#; explicit “logout” times are generally not logged because most cloud sessions expire rather than having a discrete logout event.

With a P1 license, sign-in data is retained for 30 days. There are two main approaches:

1. Download sign-in logs and process them
   1. In the Microsoft Entra admin center, go to the Sign-in events page.
   2. Apply filters (for example, specific user, time range).
   3. From the command bar, select Download and choose:
      • Download JSON – for JSON output.
      • Download CSV – for CSV output.
   4. Use C# to read the downloaded JSON/CSV file and extract createdDateTime (or equivalent) as the login time.
   Notes:
   • Up to 100,000 records per file can be downloaded.
   • For more than 100,000 records or continuous integration, use reporting APIs or export to a storage account, SIEM, or Log Analytics via Export Data Settings, then query from C#.
2. Use reporting APIs / Log export (recommended for automation)
   • Configure Export Data Settings in Entra sign-in logs to send data to a storage account, SIEM, or Log Analytics.
   • From C#, query the exported data source (for example, Azure Storage or Log Analytics) to retrieve sign-in events for the target user.
   • Treat each sign-in event’s timestamp as the login time; infer “logout” as session expiration or last activity, since explicit logout is not recorded.

Because the context provided does not include the exact Microsoft Graph or REST endpoints, the high-level pattern is:

• Use Entra sign-in logs as the source of truth.
• Export or download logs.
• Parse them in C# to get login timestamps; do not expect a reliable logout timestamp.

References:

• Find users who signed in
• How long does Microsoft Entra ID store reporting data?