Forum Discussion

SimonR's avatar
SimonR
Brass Contributor
May 15, 2020

AzureAD Signin Logs - ObjectID in Identity field

Hi,   I've been looking at the AAD Signin Logs for a few things now and I'm finding an issue where sometime the Identity and UserPrincipalName fields contain a users ObjectID rather than their name...
Azure Active Directory (AAD)
Joe Stocker's avatar
Joe Stocker
Bronze Contributor
May 16, 2020

I found these in my tenant too, but they were all unsuccessful sign-ins associated with two unique error codes from the error code lookup page here:

https://login.microsoftonline.com/error


16000 means "Either multiple user identities are available for the current request or selected account is not supported for the scenario."
and
In the case of the 50058 error, it means
"This means that a user is not signed in. This is a common error that's expected when a user is unauthenticated and has not yet signed in. If this error is encountered in an SSO context where the user has previously signed in, this means that the SSO session was either not found or invalid. This error may be returned to the application if prompt=none is specified."

 

about 20 seconds later from the same IP Address the same user signed in successfully with their normal user ID.

So in our case, we are going to filter these out, especially because the 16000 error code "remediation suggestion" is to "Hide in logs" per the error lookup tool.

Resources