LastLogin data obtained by Find-IshUser cmdlet

Question

Our company upgraded TD from TD14 to 15.2.0 last month (i.e. September, 2025). 
 I was monitoring the number of active users by gathering last login information with the PowerShell script as follows: 
 
 Find-IshUser -IshSession $ishSession | Select-Object username,fishemail,fusergroup,fishlastloginon | sort @{Expression="username";Descending=$false} | Export-Csv <CSV file path> 
 
 Before upgrading TD, we were using ISHSTS for login authentication. Now, we are using a cloud-based IdP for login authentication. When I executed the above PowerShell script today, I realized the fishlastloginon does not reflect the last login date logged in using the cloud-based IdP. It is believed that the last login date and time collected by the ISHRemote Find-IshUser cmdlet only pertains to login authentication using ISHSTS and Tridion Docs identity provider. 
 
 Could you let me how to obtain the last login date and time when logging in using both external IdP and Tridion Docs identity provider? 
 
 I'm using ISHRemove 8.1.0. 
 
 Thank you in advance for your help. 
 
 Kind regards, Naoki

Dave De Meyer · Answer

Hi Naoki-san, 
 Have a look at User's Last Log On Timestamp Impact https://community.rws.com/product-groups/tridion/tridion-docs/b/weblog/posts/automating-on-tridion-docs---ishremote-v8-0-with-modern-authentication-is-now-available . When the identity provider is not the built-in one (like ISHID or earlier ISHSTS), the timestamp is indeed not maintained as the CMS is not offering the authentication anymore. And this is advised as external identity provider have this as their main business goal. 
 A very fluffy idea was to extend Find-IshUser cmdlet but we never got it to top of the backlog. There is some data available in Access Management (typically https://ish.example.com/ISHAM/ ). Theoretically it is possible to link the user profiles (from ISHCM) with the login information (from ISHAM), so combining the two data silos. This was one of the ideas behind adding the OpenAPI proxy to Access Management $ishSession.OpenApiAM10Client.UsersGetAsync().GetAwaiter().GetResult() which of course requires Access Management administrator api privileges. 
 Best wishes, Dave

Tridion Docs Developers > 03 - Developer Forum

LastLogin data obtained by Find-IshUser cmdlet