SOLVED

Sign-In Reports

%3CLINGO-SUB%20id%3D%22lingo-sub-181560%22%20slang%3D%22en-US%22%3ESign-In%20Reports%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181560%22%20slang%3D%22en-US%22%3E%3CP%3EUntil%20recently%20we%20have%20been%20able%20(with%20an%20E3%20licence)%20to%20report%20on%20Sign-In%20successes%20and%20failures%20in%20the%20Azure%20Active%20Directory%20admin%20center.%26nbsp%3B%20This%20was%20very%20useful%20in%20attempting%20to%20track%20compromised%20accounts.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20seems%20this%20function%20is%20no%20longer%20available%20to%20us.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECould%20you%20please%20confirm%20that%20the%20only%20way%20we%20can%20continue%20to%20access%20this%20information%20is%20to%20upgrade%20our%20accounts%20to%20E5%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20your%20help.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-181560%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181579%22%20slang%3D%22en-US%22%3ERe%3A%20Sign-In%20Reports%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181579%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20Cian%20for%20your%20help.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181578%22%20slang%3D%22en-US%22%3ERe%3A%20Sign-In%20Reports%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181578%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-reporting-activity-sign-ins%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Esign-in%20activity%20report%3C%2FA%3E%20requires%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%22Your%20tenant%20must%20have%20an%20Azure%20AD%20Premium%20license%20associated%20with%20it%20to%20see%20the%20all%20up%20sign-in%20activity%20report%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPerhaps%20it%20was%20available%20during%20a%20trial%20but%20that%20might%20have%20ended%20now.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat%20means%20either%20paying%20for%20%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fpricing%2Fdetails%2Factive-directory%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20AD%20Premium%3C%2FA%3E%26nbsp%3Bor%20Enterprise%20Mobility%20%2B%20Security%20E3.%26nbsp%3B%20Office%20365%20E5%20will%20not%20help%2C%20though%20there%20is%20always%20Microsoft%20365%20Enterprise%26nbsp%3Bas%20another%20option.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%2C%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-reporting-security-user-at-risk%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EUsers%20flagged%20for%20risk%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-reporting-security-risky-sign-ins%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3ERisky%20sign-ins%20reports%3C%2FA%3E%20should%20be%20available%20with%20no%20additional%20licencing.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Until recently we have been able (with an E3 licence) to report on Sign-In successes and failures in the Azure Active Directory admin center.  This was very useful in attempting to track compromised accounts.

 

It seems this function is no longer available to us.

 

Could you please confirm that the only way we can continue to access this information is to upgrade our accounts to E5?

 

Thanks for your help.

2 Replies
Highlighted
Solution

The sign-in activity report requires the following:

 

"Your tenant must have an Azure AD Premium license associated with it to see the all up sign-in activity report"

 

Perhaps it was available during a trial but that might have ended now.

 

That means either paying for Azure AD Premium or Enterprise Mobility + Security E3.  Office 365 E5 will not help, though there is always Microsoft 365 Enterprise as another option.

 

However, the Users flagged for risk and Risky sign-ins reports should be available with no additional licencing.

Highlighted

Thank you Cian for your help.