Forum Discussion
Tony Oscar
Jul 05, 2019Copper Contributor
UserLoggedIn events not found in Azure Audit log for about a week
When I search for UserLoggedIn events in my Office 365 Tenant, I'm unable to find any audit records for the last 7 days. Whereas all our users have been logging in and out. I've tested one of our tes...
VasilMichev
Jul 05, 2019MVP
First of all, for login events best use the Azure AD sign-in logs directly, as the unified log often displays them with delay (if at all): https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins
Second, just because the users access a given application it doesn't mean they do a full-blown login. The application can reuse an already issued refresh token, and until its validity expires, you will not see any login events for the given user/app combo. But 7 days is long enough period to have at least few users try an app they haven't logged in to in a while, so it seems a bit suspicions and most likely the unified log is acting up again. Which brings us back to my previous point, check the AAD logs.