Overview
The last sign-in date in Protect reflects the most recent time a user fully completed authentication. In some cases, this date may appear blank or differ from what you see in the Azure admin portal. This article explains why.
Why the date may differ from Azure
Azure counts both successful and failed sign-in attempts when displaying the last sign-in date, so that field is always populated. Protect only counts sign-ins where the user fully completed authentication; failed attempts are excluded.
This means the date in Protect can be older than what Azure shows, or appear blank even when Azure shows a recent date.
Why the date may appear blank
The last sign-in date will be blank in Protect when:
The user has never completed a sign-in.
The user's last successful sign-in was before December 1, 2023. Microsoft only started tracking this data on that date and did not apply it retroactively.
A note on sign-in types
Protect tracks the last successful sign-in regardless of whether it was interactive (the user actively logging in) or non-interactive (a background connection from an app like Outlook, Teams, or a mobile device). There is no way to determine which type of sign-in occurred most recently in Protect at the moment.