Feb 03 2021
- last edited on
Apr 08 2022
I've followed the instructions in Monitor Azure AD B2C with Azure Monitor - Azure AD B2C | Microsoft Docs to send AuditLogs and SigninLogs to a Log Analytics Workspace.
I'm able to complete the setup correctly. I'm testing the functionality by following:
Tutorial: Register an application - Azure AD B2C | Microsoft Docs then Tutorial - Create user flows - Azure Active Directory B2C | Microsoft Docs to create a sign-up / sign-in flow that redirects to https://jwt.ms.
When I test user flows after about a 5 minute delay I can query the AuditLogs in the Log Analytics Workspace but cannot see the SigninLogs. The SigninLogs took over 24 hours to appear in the Log Analytics Workspace after the initial setup. After this long initial delay they started to flow into the Log Analytics Workspace with the same 5 minute or so lag as the AuditLogs.
Is it normal that the SigninLogs take a long to time to appear in a Log Analytics Workspace after you first set things up? Or is there some setup I'm missing?
Any help will be appreciated.
Feb 03 2021 06:37 AM
Update: I've tested this twice now with different B2C tenants. On both occasions Audit logs were available to query in the log analytics workspace roughly 5 minutes after creating the diagnostic settings. Sign-in logs were available to query in the log analytics workspace roughly 24 hours later.
After that initial 24 hour wait the Sign-in logs then became available to query in the log analytics workspace with the same 5 minute lag as the Audit logs.