Forum Discussion
Audit feed API returns user logged in message for removed user
I found incorrect message in Audit log about user log in of removed user:
{
"Operation": "UserLoggedIn",
"ResultStatus": "Succeeded",
"LogonError": "UserAccountNotFound"
}
Can someone clarify...
I noticed the same events and got this response from a Microsoft Support Escalation Engineer:
"My name is Taylor ******** and I am with the office 365 Authentication team. I see that there was a question on the Unified audit logs regarding unknown users being processed and showing Success status. So, what this means is that Azure AD was able to successfully take the attempt and process it. Then the login attempt failed to authenticate due to the user account not found. This is by design and purely means that an attempt was made and was processed."