Home

Audit Log - Login success/failure

%3CLINGO-SUB%20id%3D%22lingo-sub-309027%22%20slang%3D%22en-US%22%3EAudit%20Log%20-%20Login%20success%2Ffailure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-309027%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20the%20security%20%26amp%3B%20compliance%20centre%20you%20can%20view%20and%20filter%20the%20audit%20log%20by%20many%20products%2Factivities.%26nbsp%3B%20But%20one%20thing%20I%20can't%20do%20is%20find%20a%20filter%20that%20shows%20only%20login%20success%2Ffailure%20messages%20(and%20other%20related%20activities).%26nbsp%3B%20Is%20this%20possible%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-309027%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%20center%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-309264%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20-%20Login%20success%2Ffailure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-309264%22%20slang%3D%22en-US%22%3E%3CP%3EOr%20PowerShell.%20In%20any%20case%2C%20if%20you%20are%20interested%20in%20Login%20events%2C%20best%20use%20the%20Azure%20AD%20logs%20directly%20from%20the%20Azure%20portal%2C%20they%20offer%20much%20more%20detailed%20information%2C%20and%20are%20populated%20faster%20compared%20to%20the%20ones%20in%20the%20SCC.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-309194%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20-%20Login%20success%2Ffailure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-309194%22%20slang%3D%22en-US%22%3ENo%20with%20the%20Audit%20Log%20Search...this%20is%20something%20you%20can%20get%20with%20the%20Cloud%20App%20Security%20and%20also%20with%20some%20advanced%20reports%20in%20Azure%20AD%20but%20I%20believe%20for%20those%20reports%20you%20need%20at%20least%20an%20AAD%20Plan%201%3C%2FLINGO-BODY%3E
Highlighted
Regular Contributor

In the security & compliance centre you can view and filter the audit log by many products/activities.  But one thing I can't do is find a filter that shows only login success/failure messages (and other related activities).  Is this possible?

2 Replies
Highlighted
No with the Audit Log Search...this is something you can get with the Cloud App Security and also with some advanced reports in Azure AD but I believe for those reports you need at least an AAD Plan 1
Highlighted

Or PowerShell. In any case, if you are interested in Login events, best use the Azure AD logs directly from the Azure portal, they offer much more detailed information, and are populated faster compared to the ones in the SCC.

Related Conversations
Where Cloudshell issued commands are logged?
jjsantanna in Azure Sentinel on
3 Replies
Automatic login lost.
Jacques Van de Meerssche in Discussions on
5 Replies
Ignore bucket based on offset
Scott Allison in Azure Log Analytics on
2 Replies
Modern Authentication Issue
cvincent in Microsoft Teams on
1 Replies