User logged in activity cannot be found in Audit log search

%3CLINGO-SUB%20id%3D%22lingo-sub-2674741%22%20slang%3D%22en-US%22%3EUser%20logged%20in%20activity%20cannot%20be%20found%20in%20Audit%20log%20search%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2674741%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Team%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%20newly%20created%20tenant%20with%20Audit%20log%20enabled%20more%20than%2072-hours%20ago%20and%20Azure%20AD%20P1%20license%20enabled%20more%20than%2048-hours%20ago.%20I%20can%20view%20the%20Azure%20AD%20sign-ins%20in%20the%20Azure%20AD%20Portal%2C%20however%2C%20the%20'User%20logged%20in'%20activity%20has%20been%20empty%20in%20the%20audit%20log%20search%20%3CA%20href%3D%22https%3A%2F%2Fprotection.office.com%2Funifiedauditlog%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fprotection.office.com%2Funifiedauditlog%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screen%20Shot%202021-08-23%20at%205.34.54%20PM.png%22%20style%3D%22width%3A%20968px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F305007i805127A5613DA4AD%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Screen%20Shot%202021-08-23%20at%205.34.54%20PM.png%22%20alt%3D%22Screen%20Shot%202021-08-23%20at%205.34.54%20PM.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20another%20tenant%20which%20I%20have%20been%20subscribed%20to%20for%20over%202-years%2C%26nbsp%3BUser%20logged%20in%20activity%20can%20be%20found%20today%20even%20if%20it%20is%20on%20Azure%20AD%20Free%20license.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20anything%20I%20have%20to%20setup%20to%20enabling%20the%20sign-in%20logs%20from%20Azure%20AD%20to%20be%20made%20visible%20in%20the%20Audit%20log%20search%3F%26nbsp%3B%20We%20need%20to%20be%20able%20to%20view%20the%20sign-in%20activities%20'UserLoggedIn'%20operation%20via%20the%20management%20API%20but%20the%20data%20is%20simply%20missing%20in%20the%20new%20tenant.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Senior Member

Hi Team,

 

We have a newly created tenant with Audit log enabled more than 72-hours ago and Azure AD P1 license enabled more than 48-hours ago. I can view the Azure AD sign-ins in the Azure AD Portal, however, the 'User logged in' activity has been empty in the audit log search https://protection.office.com/unifiedauditlog

 

Screen Shot 2021-08-23 at 5.34.54 PM.png

 

 

In another tenant which I have been subscribed to for over 2-years, User logged in activity can be found today even if it is on Azure AD Free license.

 

Is there anything I have to setup to enabling the sign-in logs from Azure AD to be made visible in the Audit log search?  We need to be able to view the sign-in activities 'UserLoggedIn' operation via the management API but the data is simply missing in the new tenant.

0 Replies