SOLVED
Home

Can't drill into Sign-ins by location

%3CLINGO-SUB%20id%3D%22lingo-sub-437459%22%20slang%3D%22en-US%22%3ECan't%20drill%20into%20Sign-ins%20by%20location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-437459%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20using%20the%20Sentinel%20preview%20and%20I%20have%20the%20Azure%20AD%20sign-in%20logs%20dashboard%20installed.%26nbsp%3B%20On%20the%20locations%20pane%20of%20that%20dashboard%20it%20shows%20a%20number%20of%20logins%20from%20China%2C%20but%20when%20I%20select%20to%20view%20that%20on%20the%20analytics%20pane%20it%20doesn't%20give%20me%20any%20details%20other%20than%20the%20number%20of%20logins.%26nbsp%3B%20Is%20there%20somewhere%20that%20i%20can%20drill%20into%20it%20to%20see%20which%20accounts%20are%20logging%20in%20from%20China%3F%26nbsp%3B%20I%20have%20MFA%20enabled%20via%20EMS%20and%20nothing%20is%20alerting%20in%20my%20Azure%20AD%20premium%20regarding%20risky%20logins%20so%20not%20sure%20why%20it%20would%20be%20saying%20there%20are%20logins%20from%20China.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20822px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108294i9E0E69EA55EBE443%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22china.PNG%22%20title%3D%22china.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-438220%22%20slang%3D%22en-US%22%3ERe%3A%20Can't%20drill%20into%20Sign-ins%20by%20location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-438220%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20key%20is%20to%20remove%20the%20%22summarize%22%20line%20from%20the%20query.%26nbsp%3B%20Hope%20that%20helps%20someone%20else%20down%20the%20road%3C%2FP%3E%3C%2FLINGO-BODY%3E
Tom Reppen
New Contributor

Hello,

 

I'm using the Sentinel preview and I have the Azure AD sign-in logs dashboard installed.  On the locations pane of that dashboard it shows a number of logins from China, but when I select to view that on the analytics pane it doesn't give me any details other than the number of logins.  Is there somewhere that i can drill into it to see which accounts are logging in from China?  I have MFA enabled via EMS and nothing is alerting in my Azure AD premium regarding risky logins so not sure why it would be saying there are logins from China.

china.PNG

 

1 Reply
Solution

The key is to remove the "summarize" line from the query.  Hope that helps someone else down the road

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies