Home

Sign-in reports - missing events for specific users

Frequent Contributor
I'm poking around AAD Sign-In reports (AAD Premium license, EMS+Security E3) and notice that some of my users whom I know definitively have been signing in are no where to be found in the logs. Not a single event for certain users.
 
For example, a user with whom I am exchanging emails (he's using Outlook mobile app on his iPhone, Skype for Business for IM and PSTN calling on his phone) shows no sign-ins whatsoever. There are no filters applied to the report, I am pulling all events from the past 7 days. I am seeing this for a few other known users as well.
 
Does anyone know what might be going on or what might be causing this?
 
Thanks,
Bob
3 Replies

If apps are using Modern Authentication then you'll only see reauthentication events when the token expires, which can be forever ...

 

https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-...

 

 

As Steven said above, MA greatly reduces the number of sign-in events. I just wanted to add that if you are looking for "when was this user last active" type of report, you should look at the Unified audit log in the SCC, which should give you a lot more events. When it works, that is.

 

P.S. I wonder how many more years will have to pass until we get a LastLoginDate attribute.

We are facing similar issues. We use SailPoint to automatically disable user identities for on-premises Active Directory. There are VIPs who only use O365 services so they never logon to on-premises AD and their lastlogontimestamp is never updated. We want to build a correlation between Azure AD and on-premises AD so that before a decision is made by SailPoint to disable an account it considers both on-premises lastlogontimestamp and Azure AD sign-in logs. We face same issue as described above and there is no other attribute to refer to in AzureAD which can allow this correlation to happen. So the method we have today is not full proof and has chances to fail if we use sign-in logs as correlation attribute.

Related Conversations
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
7 Replies