New User log and dormant user report feature

Just recently, Microsoft released a new version for user logs, and based on this, a new dormant user report was created. Two weeks ago, I was checking for a new feature related to viewing the license requirement per object. I then also noticed another feature called (Preview) User log and dormant user report V2 feature. In this blog, you will learn details about the feature, how to get it activated in your Microsoft Dynamics 365 Finance and Operations environments, and some other relevant information.

Current features

Let’s first start having a look at the features that were available so far. In Dynamics 365 you can navigate to System administration > Inquiries > User log.

On this page, you can view all logins and online time. In case the session is still active, the Online time does not indicate the current elapsed time. You can also view some statistics about login quantities.

Dependent on this table, there are some features that you can use to determine if users are using the application and with what frequency. You can run a report called Dormant user security accounts (System administration > Security). When starting the report, you can specify the number of days since the last login and which account type and status to include. E.g. you can run the report for only enabled users.

As part of the User Security Governance features, there is also a page for User activity aging. On the Security governance parameters, you can define the days per bucket.

You can then check for the number of logins per period.

Why are these features important?

The user log and dormant users list help you with periodic access reviews, audits, and the worker offboarding process. Users who aren’t working anymore within the organization should at least be disabled to prevent having access to the application. With user logs, you can also monitor patterns in usage. In case of users changing roles or leaving the company, access might not be required anymore. It can answer questions like why did a user log in 10 times more in the past two weeks compared to their average usage? Why is a user suddenly logging in during the night? Did the user login at a specific date?

Another important reason to mention is licensing. Users who aren’t using the application might still be reported to require a license. To ensure having clean user licensing reports, it is mandatory to check regularly if users are not using the application anymore or have never logged in.

During security and licensing assessments we did at Next365, we found a lot of users not using the system. It is a waste to acquire licenses for users when they don’t use the service. The number of dormant users was different per organization. At one client, I found over 1000 dormant users where the user account in Dynamics 365 was not disabled! They all required a Supply Chain Management license. 1000 times the list price of $ 210 is $ 210K per month, almost $ 2.5 million a year.

Why a V2 version?

This is a question that I will try to answer with my own thoughts. Microsoft might have a different motivation. Let’s start with the fact that the User log has been deprecated already for several years. See: Removed or deprecated platform features – Finance & Operations | Dynamics 365 | Microsoft Learn

It was the intention to have the User log page removed as part of version 10.0.38, which is 10 versions ago. The main reason is that the information was not always correct, as it was built for a Windows client where log-in and log-out were captured. While using the web client, a user can just close all browser tabs or restart the laptop. There was an alternative suggested by Microsoft to get login details from Telemetry. Track user sign-ins – Finance & Operations | Dynamics 365 | Microsoft Learn

Personally, I was surprised that the feature was still available in the versions starting from 10.0.38. Even more, I was confused when Microsoft added the User Security Governance features, where the User activity aging was based on the deprecated information.

Now the time is almost there when the Dynamics 365 environment administration will be moved from LCS to PPAC, and the alternative telemetry will not be available anymore. The user logs and dormant user reporting are too important and should be available to system administrators.

(Preview) User log and dormant user report V2 feature

As mentioned in the introduction, Microsoft has now released a preview of the new user log and dormant user reporting. The feature is part of the latest quality update for version 10.0.48. After you have updated your environment, you will need to enable the feature via Feature management. If you don’t have access to feature management, you can ask your system administrator to enable the feature.

After enabling the feature, perform a hard refresh of your browser session. A new form called User log V2 is then available by navigating to this page via System Administration > Security > Security governance. The form is available to users with the role System administrator or Security administrator. Note that this V2 version is based on a new user login events log table, and data will be built up from scratch. There is no conversion option to move the data from V1 to V2.

When I enabled this about two weeks ago, no logs were visible, and when calculating dormant users, no last login was visible, and all days since last login were showing the value -1, indicating they never logged in. This was the case, even after logging out and in again and trying it with other users.

I updated two other environments, and again, no data was captured in the new user login events log table. Via the table browser, the table remained empty as well. I reached out to the product team at Microsoft, explaining that there might be an issue with enabling a flight. That got acknowledged. A software engineer checked in a fix, and I had to update my environments again. After that, Microsoft enabled the flight for my environments earlier this week. Then it started to work. I was able to test the new features, and my experiences are shared in this blog. Login events got stored, and data is visible on the form.User log V2.

The User audit report is showing all user login events. It is not storing the online time. It is only capturing the login event for auditing purposes.

Based on the log information, on the second tab page, you can view the Dormant user report. Like the legacy report, you can provide options like the inactive days and click on Show to review if users are active.

For the demo, I inserted random data in the table to get some presentable information. The report is on the screen, where you can use interactive filtering or sorting, which was not possible with the legacy report. In case users aren’t using the application anymore, you should disable these users for security purposes and licensing reporting.

Next to the reports on this form, the details on the User activity aging page will take the data from the new user login events log table in case the feature is enabled. On this page, you can analyse login counts

Known issues

I was very happy with the quick response from Microsoft and the great interactions we had, mitigating the issue with this feature, where no logs were being captured. We found an issue together about not being able to see records in a company other than the DAT company. I did do some more in-depth testing and provided feedback to Microsoft. The next points are on the list for Microsoft to enhance before the feature is out of the preview status.

• User login events not triggered: In case there are no logs captured, you might still need to wait for an automatic flight enablement, which activates the capturing of data. This will be rolled out to environments automatically in the coming weeks.
• Data not visible: In the current version, the table storing the login events is set to save data per company. All logs are inserted into the DAT company. The table will be made global in a future release, so you can view the data starting from any company.
• Entra ID groups: The current view shows records with Account type Claims group. These are Entra ID groups. They are also visible in the legacy reports. The Entra ID groups will be removed from the report in a next release.
• Disabled users: If a user tries to log in with an account that is not enabled, they will receive an error stating that they are not authorized to log in with their current credentials. Despite this authentication denial, a login event is stored for the user. This behavior will be fixed.
• Terminology consistency: There is a naming difference between the account type in the grid and the enumeration label of the filter field (Microsoft Entra ID user versus Active Directory user. The filter is working today, but the naming will be aligned in the future.
• Cleanup job: The legacy user log comes with a cleanup job to periodically delete older, obsolete records. A cleanup task for the new V2 version is on the roadmap.

There is more…

Microsoft provided documentation for this feature. You can read more here: User log and dormant user report V2 for finance and operations (preview) – Finance & Operations | Dynamics 365 | Microsoft Learn

The article describes the minimum version of the platform required to use the feature, which is due to the implemented fixes now 7.0.7996.76 instead of 7.0.7996.40. In case you have Lifecycle Services (LCS) as the admin center for your Dynamics 365 environments, you can get the latest version via the daily updates. The latest drop might not (yet) be available for unified environments in the Power Platform Admin Center (PPAC).

In the documentation, you can read that the new feature and the legacy user log will work next to each other for the coming period. There is no automated migration from the old user logs to the new table. This means that you will need to use both logs, for e.g. the coming 2 months. In case the new report states that the user is inactive, the old report can still show the latest activity from 2 weeks ago. After your usual period for checking inactive users, you can fully rely on the new reports. Note that the User activity aging does not have a switch to use the legacy logs apart from disabling the feature. I recommend enabling the new (Preview) User log and dormant user report V2 feature as soon as possible in your environments.

As mentioned above, the user logins are stored in a new table with the name SysUserLoginEventsLog. The reports are taking the values of the field CreatedDateTime as the source. The table contains information about the user, but also two date/time fields: NotBeforeDateTime and ExpiryDateTime. These fields represent the validity of the authentication token.

In case you want to build custom reports based on the new logins, you can export the data from the grid or use the standard Export to Excel option. There is no data entity provided. You can enable the table SysUserLoginEventsLog in the Fabric or Synapse link. You can then use the information in Power BI reports.

As the old User log functionality was announced as deprecated, I do expect that, although the features will work side-by-side, the legacy will be removed over time. Before that will be the case, the feature first needs to become generally available (GA), n by default, and then mandatory. For that reason, the features will most likely work simultaneously for at least the coming year.

I do hope you liked this post and will add value for you in your daily work as a professional. If you have related questions or feedback, don’t hesitate to use the Comment feature below.


That’s all for now. Till next time!