Home

Audit Log - Login success/failure

%3CLINGO-SUB%20id%3D%22lingo-sub-309027%22%20slang%3D%22en-US%22%3EAudit%20Log%20-%20Login%20success%2Ffailure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-309027%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20the%20security%20%26amp%3B%20compliance%20centre%20you%20can%20view%20and%20filter%20the%20audit%20log%20by%20many%20products%2Factivities.%26nbsp%3B%20But%20one%20thing%20I%20can't%20do%20is%20find%20a%20filter%20that%20shows%20only%20login%20success%2Ffailure%20messages%20(and%20other%20related%20activities).%26nbsp%3B%20Is%20this%20possible%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-309027%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%20center%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-309264%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20-%20Login%20success%2Ffailure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-309264%22%20slang%3D%22en-US%22%3E%3CP%3EOr%20PowerShell.%20In%20any%20case%2C%20if%20you%20are%20interested%20in%20Login%20events%2C%20best%20use%20the%20Azure%20AD%20logs%20directly%20from%20the%20Azure%20portal%2C%20they%20offer%20much%20more%20detailed%20information%2C%20and%20are%20populated%20faster%20compared%20to%20the%20ones%20in%20the%20SCC.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-309194%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20-%20Login%20success%2Ffailure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-309194%22%20slang%3D%22en-US%22%3ENo%20with%20the%20Audit%20Log%20Search...this%20is%20something%20you%20can%20get%20with%20the%20Cloud%20App%20Security%20and%20also%20with%20some%20advanced%20reports%20in%20Azure%20AD%20but%20I%20believe%20for%20those%20reports%20you%20need%20at%20least%20an%20AAD%20Plan%201%3C%2FLINGO-BODY%3E
Highlighted
Regular Contributor

In the security & compliance centre you can view and filter the audit log by many products/activities.  But one thing I can't do is find a filter that shows only login success/failure messages (and other related activities).  Is this possible?

2 Replies
Highlighted
No with the Audit Log Search...this is something you can get with the Cloud App Security and also with some advanced reports in Azure AD but I believe for those reports you need at least an AAD Plan 1
Highlighted

Or PowerShell. In any case, if you are interested in Login events, best use the Azure AD logs directly from the Azure portal, they offer much more detailed information, and are populated faster compared to the ones in the SCC.