Forum Discussion

Copper Contributor

Oct 06, 2019

Unable to view Signin logs in Log Analytics Workspace

Hi I've setup the Audit logs and Sign-in logs from AAD to be sent to Log Analytics Workspace. The user has EMS E5 license. I could see the sign in logs being populated when i view it from the Azure ...

Azure Log Analytics

azure monitor

CliveWatson

Former Employee

Oct 07, 2019

Have you checked all the pre-requisites? https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory

MohanRavindran

Microsoft

Jan 30, 2020

CliveWatson

I've checked all the pre-req's . All of them are met. I could see the Audit logs just not the Sign in logs.

CliveWatson
Former Employee
Jan 31, 2020
MohanRavindran

If you have recent logs (within 12hrs) but nothing on this screen for sign-in a support call may be needed - unless anyone else has an idea? I assume you have RBAC right to the Signinlogs table as well as Auditlogs?
- Jukesnthings
  Copper Contributor
  Jan 13, 2021
  CliveWatson
  
  I have the same issue on a brand new tenant. I am able to see the SignIn logs from the AAD > Monitoring > Sign-ins blade, but it won't stream to my Log Workspace. I replicated the process with AuditLogs and it worked fine within 5 minutes.
  
  The account is a Global Admin, so permissions shouldn't be an issue. I tried fixing it via Support today, but we were unable to resolve and it has been escalated. I'll respond here if I find a resolution.
  - VPIDev
    Copper Contributor
    Jun 28, 2021
    JukesnthingsWere you able to find a solution?