SOLVED
Home

Retrieve old reporting data

%3CLINGO-SUB%20id%3D%22lingo-sub-82099%22%20slang%3D%22en-US%22%3ERetrieve%20old%20reporting%20data%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-82099%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20client%20did%20not%20realize%20that%20SSPR%20reporting%20data%20was%20only%20kept%20for%2030%20days%20and%20now%20they%20want%20to%20do%20some%20historical%20trending%20but%20don't%20have%20the%20older%20data.%20Is%20there%20any%20way%20to%20get%20that%20data%20or%20are%20they%20out%20of%20luck%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-82099%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-84224%22%20slang%3D%22en-US%22%3ERE%3A%20Retrieve%20old%20reporting%20data%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-84224%22%20slang%3D%22en-US%22%3EYour%20client%20is%20out%20of%20luck.%20%22Currently%2C%20the%20Azure%20AD%20Reports%20and%20Events%20API%20retrieves%20up%20to%2075%2C000%20individual%20events%20of%20the%20SsprActivityEvent%20and%20SsprRegistrationActivityEvent%20types%2C%20spanning%20the%20last%2030%20days.%2B%20If%20you%20need%20to%20retrieve%20or%20store%20data%20beyond%20this%20window%2C%20we%20suggest%20persisting%20it%20in%20an%20external%20database%20and%20using%20the%20API%20to%20query%20the%20deltas%20that%20result.%20Our%20recommendation%20is%20to%20begin%20retrieving%20this%20data%20when%20you%20start%20using%20SSPR%20in%20your%20organization%2C%20persist%20it%20externally%2C%20and%20then%20continue%20to%20track%20the%20deltas%20from%20this%20point%20forward.%22%20Reference%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-reporting%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-reporting%3C%2FA%3E%3C%2FLINGO-BODY%3E
Dean Gross
Respected Contributor

My client did not realize that SSPR reporting data was only kept for 30 days and now they want to do some historical trending but don't have the older data. Is there any way to get that data or are they out of luck?

1 Reply
Solution
Your client is out of luck. "Currently, the Azure AD Reports and Events API retrieves up to 75,000 individual events of the SsprActivityEvent and SsprRegistrationActivityEvent types, spanning the last 30 days.+ If you need to retrieve or store data beyond this window, we suggest persisting it in an external database and using the API to query the deltas that result. Our recommendation is to begin retrieving this data when you start using SSPR in your organization, persist it externally, and then continue to track the deltas from this point forward." Reference: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-reporting
Related Conversations
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
7 Replies