In this article, we will briefly explain what the "activeLast30Days" datapoint for Microsoft 365 users mean.

This datapoint comes from the graph “getMailboxUsageDetail” endpoint. We look to see if the date returned from “lastActivityDate” is 30 or less, and will set this data accordingly. This means if Microsoft sees the user as having what they consider “activity” within the last 30 days, this flag will be true.

Please note that this is not the same as last login time, as Microsoft measures activity differently.

For additional information, please visit Microsoft's documentation.