Sign-in reports - missing events for specific users

Question

I'm poking around AAD Sign-In reports (AAD Premium license, EMS+Security E3) and notice that some of my users whom I know definitively have been signing in are no where to be found in the logs. Not a single event for certain users.

For example, a user with whom I am exchanging emails (he's using Outlook mobile app on his iPhone, Skype for Business for IM and PSTN calling on his phone) shows no sign-ins whatsoever. There are no filters applied to the report, I am pulling all events from the past 7 days. I am seeing this for a few other known users as well.

Does anyone know what might be going on or what might be causing this?

Thanks,
Bob

stevenc365 · Answer

If apps are using Modern Authentication then you'll only see reauthentication events when the token expires, which can be forever ...
&nbsp;
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes
&nbsp;
&nbsp;

vasilmichev · Answer

As Steven said above, MA greatly reduces the number of sign-in events. I just wanted to add that if you are looking for "when was this user last active" type of report, you should look at the Unified audit log in the SCC, which should give you a lot more events. When it works, that is.
&nbsp;
P.S. I wonder how many more years will have to pass until we get a LastLoginDate attribute.

alpesh shinde · Answer

We are facing similar issues. We use SailPoint to automatically disable user identities for on-premises Active Directory. There are VIPs who only use O365 services so they never logon to on-premises AD and their lastlogontimestamp is never updated. We want to build a correlation between Azure AD and on-premises AD so that before a decision is made by SailPoint to disable an account it considers both on-premises lastlogontimestamp and Azure AD sign-in logs. We face same issue as described above and there is no other attribute to refer to in AzureAD which can allow this correlation to happen. So the method we have today is not full proof and has chances to fail if we use sign-in logs as correlation attribute.

_matthias_ · Answer

Are there any news about a potential LastLoginDate attribute? I'm missing it, too!!!

erickolaez · Answer

Alpesh Shinde&nbsp;Have&nbsp;you found any solution for the correlation between AD and AAD?

Forum Discussion

Sign-in reports - missing events for specific users

Share

Resources