Setting up Azure AD B2C Sign-in Logs to go a Log Analytics Workspace

%3CLINGO-SUB%20id%3D%22lingo-sub-2112328%22%20slang%3D%22en-US%22%3ESetting%20up%20Azure%20AD%20B2C%20Sign-in%20Logs%20to%20go%20a%20Log%20Analytics%20Workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2112328%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20followed%20the%20instructions%20in%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory-b2c%2Fazure-monitor%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EMonitor%20Azure%20AD%20B2C%20with%20Azure%20Monitor%20-%20Azure%20AD%20B2C%20%7C%20Microsoft%20Docs%3C%2FA%3E%26nbsp%3Bto%20send%20AuditLogs%20and%20SigninLogs%20to%20a%20Log%20Analytics%20Workspace.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20able%20to%20complete%20the%20setup%20correctly.%26nbsp%3B%20I'm%20testing%20the%20functionality%20by%20following%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory-b2c%2Ftutorial-register-applications%3Ftabs%3Dapp-reg-ga%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ETutorial%3A%20Register%20an%20application%20-%20Azure%20AD%20B2C%20%7C%20Microsoft%20Docs%3C%2FA%3E%26nbsp%3Bthen%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory-b2c%2Ftutorial-create-user-flows%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ETutorial%20-%20Create%20user%20flows%20-%20Azure%20Active%20Directory%20B2C%20%7C%20Microsoft%20Docs%3C%2FA%3E%26nbsp%3Bto%20create%20a%20sign-up%20%2F%20sign-in%20flow%20that%20redirects%20to%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fjwt.ms%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fjwt.ms%3C%2FA%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20test%20user%20flows%20after%20about%20a%205%20minute%20delay%20I%20can%20query%20the%20AuditLogs%20in%20the%20Log%20Analytics%20Workspace%20but%20cannot%20see%20the%20SigninLogs.%26nbsp%3B%20The%20SigninLogs%20took%20over%2024%20hours%20to%20appear%20in%20the%20Log%20Analytics%20Workspace%20after%20the%20initial%20setup.%26nbsp%3B%20After%20this%20long%20initial%20delay%20they%20started%20to%20flow%20into%20the%20Log%20Analytics%20Workspace%20with%20the%20same%205%20minute%20or%20so%20lag%20as%20the%20AuditLogs.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20it%20normal%20that%20the%20SigninLogs%20take%20a%20long%20to%20time%20to%20appear%20in%20a%20Log%20Analytics%20Workspace%20after%20you%20first%20set%20things%20up%3F%26nbsp%3B%20Or%20is%20there%20some%20setup%20I'm%20missing%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20help%20will%20be%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKarl%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2112688%22%20slang%3D%22en-US%22%3ERe%3A%20Setting%20up%20Azure%20AD%20B2C%20Sign-in%20Logs%20to%20go%20a%20Log%20Analytics%20Workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2112688%22%20slang%3D%22en-US%22%3E%3CP%3EUpdate%3A%20I've%20tested%20this%20twice%20now%20with%20different%20B2C%20tenants.%26nbsp%3B%20On%20both%20occasions%20Audit%20logs%20were%20available%20to%20query%20in%20the%20log%20analytics%20workspace%20roughly%205%20minutes%20after%20creating%20the%20diagnostic%20settings.%26nbsp%3B%20Sign-in%20logs%20were%20available%20to%20query%20in%20the%20log%20analytics%20workspace%20roughly%2024%20hours%20later.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAfter%20that%20initial%2024%20hour%20wait%20the%20Sign-in%20logs%20then%20became%20available%20to%20query%20in%20the%20log%20analytics%20workspace%20with%20the%20same%205%20minute%20lag%20as%20the%20Audit%20logs.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

Hi,

 

I've followed the instructions in Monitor Azure AD B2C with Azure Monitor - Azure AD B2C | Microsoft Docs to send AuditLogs and SigninLogs to a Log Analytics Workspace.

 

I'm able to complete the setup correctly.  I'm testing the functionality by following:

Tutorial: Register an application - Azure AD B2C | Microsoft Docs then Tutorial - Create user flows - Azure Active Directory B2C | Microsoft Docs to create a sign-up / sign-in flow that redirects to https://jwt.ms.

 

When I test user flows after about a 5 minute delay I can query the AuditLogs in the Log Analytics Workspace but cannot see the SigninLogs.  The SigninLogs took over 24 hours to appear in the Log Analytics Workspace after the initial setup.  After this long initial delay they started to flow into the Log Analytics Workspace with the same 5 minute or so lag as the AuditLogs.

 

Is it normal that the SigninLogs take a long to time to appear in a Log Analytics Workspace after you first set things up?  Or is there some setup I'm missing?

 

Any help will be appreciated.

 

Thanks

 

Karl

 

 

 

 

1 Reply

Update: I've tested this twice now with different B2C tenants.  On both occasions Audit logs were available to query in the log analytics workspace roughly 5 minutes after creating the diagnostic settings.  Sign-in logs were available to query in the log analytics workspace roughly 24 hours later.

 

After that initial 24 hour wait the Sign-in logs then became available to query in the log analytics workspace with the same 5 minute lag as the Audit logs.