Set up scheduled scans or scripts that run at specific intervals to identify inactive users. These scans can query logs or network devices to gather information about user activities.

User Activity Logs:

    Filter by User Binding: Go to "Log & Report > Security Log".
    Apply Filters:
        Set "Log Type" to "User Binding".
        Select "Source MAC Address" from the dropdown and enter the desired MAC address or use wildcards (*) for broader searches.
        Consider additional filters like "Action" (e.g., "Successful Login", "Successful Logout") and "Interface" (if relevant) to refine results.
    Analyze Logs:
        Look for "Successful Login" events followed by no subsequent "Successful Logout" entries. This indicates an inactive user still consuming resources.
        Note the login timestamps to determine user inactivity duration.

Active User List:

    Access List: Go to "Security > User Mgmt > Active User List".
    Review Entries: This list shows currently active users and their relevant details (MAC address, login time, session duration).
    Identify Inactive Users: Compare the timestamps here with your expected user activity patterns. Users absent from this list for extended periods beyond their typical active hours are likely inactive.

Custom Reports:

    Generate Report: Go to "Log & Report > Custom Report".
    Select Elements: Include relevant fields like "User Name", "Source MAC Address", "First Login Time", "Last Activity Time", "Status" (e.g., "Active", "Inactive").
    Filter Criteria: Apply filters based on MAC address range, desired inactivity duration, or other criteria to pinpoint inactive users efficiently.
    Schedule Reports: Consider automating report generation and delivery for regular monitoring.

Additional Recommendations:

    Set a Clear Inactivity Threshold: Define a reasonable timeframe for considering a user inactive based on your organization's security policies and user behavior patterns.
    Incorporate Additional Factors: While MAC address binding offers basic monitoring, consider integrating user login credentials or endpoint management solutions for more granular tracking.
    Regularly Review and Update: Periodically assess and adjust your tracking methods and thresholds to adapt to evolving needs and security best practices.

By effectively combining these strategies, you can accurately track inactive users, ensure optimal internet resource utilization, and enhance your overall network security posture.

Hi, you can explore the "Custom Reports" on Log & Reports, so you can build an report where you can get all information that you want.

You can check the logs on the users login and activities

To track inactive users who have not logged in or inactive internet users along with their last logged-in dates, you can implement a monitoring system within your network infrastructure. This system should log the MAC addresses of devices accessing the internet and their corresponding timestamps of last activity. By regularly querying this log, you can identify devices that have not accessed the network for a certain period, indicating inactive users. You can cross-reference this data with the user binding records in your Access Management system to correlate MAC addresses with specific users. This approach allows you to efficiently trace inactive users and manage network access effectively.

Using the Entra ID Governance Access Review feature, it's possible to identify accounts that have not been actively used

I am glad to see lots of replies, but most of them were posted without any proper solution. If sangfor IAG could have the column to display the LAST LOGGED IN DATE in the users binding section, life would have become so easy. Strange that this simple task is this much annoying to find.