Forum Discussion

Ben Owens's avatar
Ben Owens
Brass Contributor
Sep 21, 2020

SignInLogs are not showing in Log Analytics / Azure Monitor

I have followed the steps to create an Log Analytics workspace, and configured the Diagnostic Settings in Azure AD to send the SignInLogs and AuditLogs to LogAnalytics. However, I cannot see the...
Azure Active Directory (AAD)
Log Analytics
ibnmbodji's avatar
ibnmbodji
Iron Contributor
Feb 17, 2021

Ben Owens 

 

Hi yes  it seems that even if you can configure it and send it to log analytics you need P1 license  to query and export data settings . I thought that  i can because of this : 

How long does Azure AD store the data?

Activity reports

HOW LONG DOES AZURE AD STORE THE DATA?Report Azure AD Free Azure AD Premium P1 Azure AD Premium P2
Audit logs7 days30 days30 days
Sign-ins7 days30 days30 days
Azure AD MFA usage30 days30 days30 days
Sergg's avatar
Sergg
Iron Contributor
Mar 24, 2021
Hello, I got the same issue in my purpose built demo tenant - all the eval licenses present, everything is configured, EMS E5 (Eval), Azure (Free Eval with credit), AAD is P2 (eval) but SignIn logs are not showing in Log Analytics Workspace. What is the final take on this? It is about 12 hours since config applied. How to get this flushed?
  • Ben Owens's avatar
    Ben Owens
    Brass Contributor
    Mar 26, 2021
    You note that your using eval licenses. Along with your eval licenses, I personally think you should buy just one Azure AD Premium 1 license to help get things outputting to Log Analytics more quickly.

    If be interested to know if that speeds things along.
    • KalimanneJ's avatar
      KalimanneJ
      Iron Contributor
      Aug 30, 2021

      Ben Owens  Sergg I am also missing sign-in logs even after waiting 24 hours.

      Are evaluation trial licensing not supposed to be full featured or is it a bug that Microsoft needs to fix?

      Are there some extra steps required to test setting up email alerts for sign-in activity (breakglass account etc.) when using P1/P2 trial licensing?

       

      • Ben Owens's avatar
        Ben Owens
        Brass Contributor
        Sep 01, 2021

        KalimanneJ I should have waited a few minutes more.

         

        I now have the SignInLogs showing as well.  So within 15-20 minutes of setting up the diagnostics, I have both SignInLogs and AuditLogs showing in AzureMonitor/LogAnalytics.

         

        Could you purchase 1 Azure AD P1 or Azure AD P2 license for your trial tenant and see whether that kicks things into action on your tenant and results in the SignInLogs being output?

         

        Not sure about the context of your work, but if it's testing, then it may be worth spinning up a developer tenant as the licenses run for a longer time and, as proved above, outputs the SignInLogs successfully without having to purchase a license.

Resources