LoginLedger
Signed out
Sign out
LoginLedger
LoginLedger
MDR user activity reporting

Sign in

Use your Microsoft work account to continue.

Access is limited to authorized MDR administrators and readers (LoginLedger Readers and Administrators groups).

Dashboard

All times ET (America/New_York)
Online Offline (locked, disconnected, or signed out) App launch Windows 365 sign-in Maverick sign-in Other Entra sign-in Failed sign-in
UserTimeline FirstLast Online h SessionsFlagsVisits
Day detail for the selected date plus that user's week.
Pick a user.
UserDays workedOnline hOffline hLateEarlyLong offlineFailed sign-insNo activityMon to Sun (online h)

DeviceStatusLast check-inLast Windows eventLast userCollector

Downloads

CSV exports for the selected Eastern date. Times in every file are America/New_York.

Deployment

Download the installer for NinjaOne. The upload URL and ingest key are filled in. Treat the Install script as a secret.

Loading…

NinjaOne steps

  1. Optional: create secure variable LOGINLEDGER_KEY. The Install script embeds the key; the variable overrides it if set.
  2. Create a Ninja script from the Install download. Run as SYSTEM on the Windows 365 Cloud PC group.
  3. Schedule the same script daily for self-healing.
  4. Confirm output ends with HEALTHY. Exit code 1 means UNHEALTHY.
  5. Add users to LoginLedger Monitored Users, and yourself to LoginLedger Administrators.
Rotate ingest key

After rotating the Cloudflare secret, every Cloud PC must run a heal with a freshly downloaded Install script.


              

            

          

        

      


      

        

          
Tenant & Identity

          
Repoint LoginLedger to another Entra tenant. Saving runs a connection test first. The env-configured tenant and Administrators group remain a break-glass fallback if D1 settings go wrong.

          

            

              
              
              
              

              
              
              
              
              
              

                
                
              

              

            

            

              
Connection checks

              
Run a test to see results.

              

                Break-glass
                
Members of the env-configured Administrators group () can always sign in as admin, even if D1 group IDs are wrong.

              

            

          

        

      


      

        

          

            
            
            
            
            
            
          

          
General
All dashboards, timelines, reports and emails use this time zone.
Sessions with no logoff are closed after this many hours.

          
Schedule & Flags

                
                
                
                
Workdays
Shift times are in the display time zone. 9:00 PM to 6:00 AM Manila is 9:00 AM to 6:00 PM EDT (8:00 AM to 5:00 PM EST).

          
Tracked Entra apps

          
Sign-ins for these apps are pulled every 15 minutes for Monitored Users and shown on the timeline.

          
IncludeLabelApp ID

          

          
Collection
Browser history and Windows session events are uploaded by the Cloud PC collector (see Deployment). Entra sign-ins, including non-interactive Windows 365 sign-ins, are pulled from Microsoft Graph every 15 minutes.

          
Notifications

              
              
              
Sender domain must be onboarded to Cloudflare Email Sending on this account.

          
Sync now

          
Runs the Monitored Users group sync and the Entra sign-in pull for all tracked apps right away. Limited to once per 15 seconds.

          

          

          

          

        

      


      

      
Not authorized
This page is for LoginLedger Administrators. Ask an admin to add you to the Administrators group.
Go to the dashboard

      

        
When (ET)ActorActionDetail