Forum Discussion

weslowsk's avatar
weslowsk
Copper Contributor
Jul 03, 2024

No results when creating alert rule

I've been following this documentation for creating emergency users:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access#monitor-sign-in-and-audit-logs

 

However, I'm unable to get any results when I'm creating and testing the alert rule.

 

What am I missing?

2 Replies

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Jul 05, 2024

    weslowsk 

     

    Please locate the cause by following steps:

     

    1. Check Alert Processing Rule:

    2. Email Notifications:

    3. Additional Troubleshooting such as firewall rules, etc.

    • weslowsk's avatar
      weslowsk
      Copper Contributor
      Jul 05, 2024
      The sign in logs aren't streamed into the log analytics workspace by default. Once I explicitly set that up, it started working, albeit not right away (i.e. it started working the next morning).