Forum Discussion

Ben Owens's avatar
Ben Owens
Brass Contributor
Sep 21, 2020

SignInLogs are not showing in Log Analytics / Azure Monitor

I have followed the steps to create an Log Analytics workspace, and configured the Diagnostic Settings in Azure AD to send the SignInLogs and AuditLogs to LogAnalytics. However, I cannot see the...
Azure Active Directory (AAD)
Log Analytics
ibnmbodji's avatar
ibnmbodji
Steel Contributor
Feb 16, 2021

Ben Owens 

 

Hi it's  not a matter of License since  the  sign-in activity report is available in all editions of Azure AD.

 

I would suggest to verify that you have one of the  prerequisites : 

  • Users in the Security Administrator, Security Reader, Global Reader, and Report Reader roles
  • Global Administrators
    • Russell McKee's avatar
      Russell McKee
      Copper Contributor
      May 06, 2022

      Ben Owens 

      I had this in a real tenant with AAD P1. I waited over 1 week. I thought i was going crazy (bad config etc), but all checked out correctly.

      I raised a ticket with Microsoft yesterday with the details of the tenant, screenshots etc. Had a call back today saying its all fixed. There was a global issue causing the SignInLogs to not be sent to Log Analytics. He didnt expand on the problem, but informed me Microsoft had a team of engineers looking to fix this for other customers. By the time we then checked our tenant, it was fixed anyway! So worth raising with Microsoft of you have set it up correctly and have the correct licenses etc.

    • ibnmbodji's avatar
      ibnmbodji
      Steel Contributor
      Feb 17, 2021

      Ben Owens 

       

      Hi yes  it seems that even if you can configure it and send it to log analytics you need P1 license  to query and export data settings . I thought that  i can because of this : 

      How long does Azure AD store the data?

      Activity reports

      HOW LONG DOES AZURE AD STORE THE DATA?Report Azure AD Free Azure AD Premium P1 Azure AD Premium P2
      Audit logs7 days30 days30 days
      Sign-ins7 days30 days30 days
      Azure AD MFA usage30 days30 days30 days
      • Sergg's avatar
        Sergg
        Iron Contributor
        Mar 24, 2021
        Hello, I got the same issue in my purpose built demo tenant - all the eval licenses present, everything is configured, EMS E5 (Eval), Azure (Free Eval with credit), AAD is P2 (eval) but SignIn logs are not showing in Log Analytics Workspace. What is the final take on this? It is about 12 hours since config applied. How to get this flushed?
  • toggenjm's avatar
    toggenjm
    Copper Contributor
    Feb 16, 2021

    ibnmbodji 

     

    To ship the logs to a Log Analytics Workspace you need P1 or P2

     

     

    • ibnmbodji's avatar
      ibnmbodji
      Steel Contributor
      Feb 17, 2021

      toggenjm 

      Hi Yes you're right only Audit logs are sent to log analytics when you don't have P1 License.

       
  • toggenjm's avatar
    toggenjm
    Copper Contributor
    Feb 16, 2021
    I am using my Global Administrator account to try and view the logs and it should have the permissions. As a test I have added it to the above groups and re-logged in but this hasn't made the SignInLogs table appear in Log Analytics

Resources