Unable to view Signin logs in Log Analytics Workspace

%3CLINGO-SUB%20id%3D%22lingo-sub-895691%22%20slang%3D%22en-US%22%3EUnable%20to%20view%20Signin%20logs%20in%20Log%20Analytics%20Workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-895691%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%3CP%3EI've%20setup%20the%20Audit%20logs%20and%20Sign-in%20logs%20from%20AAD%20to%20be%20sent%20to%20Log%20Analytics%20Workspace.%20The%20user%20has%20EMS%20E5%20license.%20I%20could%20see%20the%20sign%20in%20logs%20being%20populated%20when%20i%20view%20it%20from%20the%20Azure%20AD%20tile.%20However%20%2Cwhen%20i%20click%20on%20LA%20workspace%20and%20filter%20for%20Sign-in%20logs%2C%20there%20are%20no%20results.%20I%20could%20see%20the%20Auditlogs%20in%20this%20LA%20workspace%20just%20fine.%20Not%20sure%20if%20there%20are%20any%20configuration%20i'm%20missing%20which%20blocks%20me%20to%20see%20the%20logs%20under%20LA%20workspace.%20Any%20suggestions%3F%3C%2FP%3E%3CP%3EThank%20You!%3C%2FP%3E%3CP%3ERegards%3C%2FP%3E%3CP%3EMohan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-895691%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-896345%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20view%20Signin%20logs%20in%20Log%20Analytics%20Workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-896345%22%20slang%3D%22en-US%22%3EHave%20you%20checked%20all%20the%20pre-requisites%3F%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fconnect-azure-active-directory%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fconnect-azure-active-directory%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1142191%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20view%20Signin%20logs%20in%20Log%20Analytics%20Workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1142191%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI've%20checked%20all%20the%20pre-req's%20.%20All%20of%20them%20are%20met.%20I%20could%20see%20the%20Audit%20logs%20just%20not%20the%20Sign%20in%20logs.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1144193%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20view%20Signin%20logs%20in%20Log%20Analytics%20Workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1144193%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F416140%22%20target%3D%22_blank%22%3E%40MohanRavindran%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20have%20recent%20logs%20(within%2012hrs)%20but%20nothing%20on%20this%20screen%20for%20sign-in%20a%20support%20call%20may%20be%20needed%20-%20unless%20anyone%20else%20has%20an%20idea%3F%26nbsp%3B%20I%20assume%20you%20have%20RBAC%20right%20to%20the%20Signinlogs%20table%20as%20well%20as%20Auditlogs%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168344i4B31DEA845CB817A%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Visitor

Hi

I've setup the Audit logs and Sign-in logs from AAD to be sent to Log Analytics Workspace. The user has EMS E5 license. I could see the sign in logs being populated when i view it from the Azure AD tile. However ,when i click on LA workspace and filter for Sign-in logs, there are no results. I could see the Auditlogs in this LA workspace just fine. Not sure if there are any configuration i'm missing which blocks me to see the logs under LA workspace. Any suggestions?

Thank You!

Regards

Mohan

3 Replies
Highlighted
Highlighted

@Clive Watson 

I've checked all the pre-req's . All of them are met. I could see the Audit logs just not the Sign in logs.

Highlighted

@MohanRavindran 

 

If you have recent logs (within 12hrs) but nothing on this screen for sign-in a support call may be needed - unless anyone else has an idea?  I assume you have RBAC right to the Signinlogs table as well as Auditlogs?

 

clipboard_image_0.png