Enterprise Applications sign-ins review

%3CLINGO-SUB%20id%3D%22%5C%26quot%3Blingo-sub-3153283%5C%26quot%3B%22%20slang%3D%22%5C%26quot%3Ben-US%5C%26quot%3B%22%3EEnterprise%20Applications%20sign-ins%20review%26lt%3B%5C%2Flingo-sub%26gt%3B%3CLINGO-BODY%20id%3D%22%5C%26quot%3Blingo-body-3153283%5C%26quot%3B%22%20slang%3D%22%5C%26quot%3Ben-US%5C%26quot%3B%22%3E%3CP%3EGood%20day%20to%20all%2C%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%3C%2FP%3E%3CP%3EIs%20there%20any%20way%20to%20get%20sign-in%20logs%20for%20a%20large%20number%20of%20Enterprise%20Applications%20using%20PowerShell%20or%20any%20other%20automation%20tools%3F%26lt%3B%5C%2FP%26gt%3B%3C%2FP%3E%3CP%3EThe%20issue%20is%20the%20following%3A%20there%20are%20a%20lot%20of%20registered%20applications%20(about%20300)%20in%20Enterprise%20Applications%20and%20most%20of%20them%20are%20not%20in%20use.%20We%20are%20going%20to%20remove%20them%2C%20but%20first%20of%20all%2C%20we%20need%20to%20understand%20what%20apps%20are%20not%20in%20use.%20Going%20through%20each%20of%20them%20and%20checking%20will%20take%20a%20lot%20of%20time.%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%3C%2FP%3E%3CP%3EDoes%20anybody%20have%20experience%20with%20it%3F%20Probably%20it%20can%20be%20done%20via%20Log%20Analytics%20Workspace%20logs%20%2F%20Sentinel%3F%26lt%3B%5C%2FP%26gt%3B%26lt%3B%5C%2Flingo-body%26gt%3B%3CLINGO-LABS%20id%3D%22%5C%26quot%3Blingo-labs-3153283%5C%26quot%3B%22%20slang%3D%22%5C%26quot%3Ben-US%5C%26quot%3B%22%3E%3CLINGO-LABEL%3EApps%26lt%3B%5C%2Flingo-label%26gt%3B%3CLINGO-LABEL%3EAzure%26lt%3B%5C%2Flingo-label%26gt%3B%3CLINGO-LABEL%3EAzure%20Active%20Directory%20(AAD)%26lt%3B%5C%2Flingo-label%26gt%3B%26lt%3B%5C%2Flingo-labs%26gt%3B%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3C%2FLINGO-SUB%3E
Contributor

Good day to all, 

 

Is there any way to get sign-in logs for a large number of Enterprise Applications using PowerShell or any other automation tools?

The issue is the following: there are a lot of registered applications (about 300) in Enterprise Applications and most of them are not in use. We are going to remove them, but first of all, we need to understand what apps are not in use. Going through each of them and checking will take a lot of time. 

Does anybody have experience with it? Probably it can be done via Log Analytics Workspace logs / Sentinel?

2 Replies
Hi @mikhailf,

You could get an overview of the usage/sign-in per application using Workbooks. If you are not familiar with the feature, you might want to use this blog. You might need to run some queries to get the output: https://samilamppu.com/2019/08/20/using-azure-ad-workbooks-for-monitoring/
Hello BilalelHadd,
Thank you for your advice.
The "Sign-in" report in Sentinel can partially help to analyze all applications.