Forum Discussion

KemalM's avatar
KemalM
Copper Contributor
May 07, 2020

Azure AD Sign-ins Logs

Hello,   When I look at Azure AD Sign-ins Logs, I see many different applications. Some of them are very clear, but not all. For example, what are    dev-rel-auth-prod AEO Frontend Production A...
Azure Active Directory (AAD)
JordyBlommaert's avatar
JordyBlommaert
Brass Contributor

Office 365 Shell WCSS-Client is the browser code that runs whenever a user navigates to (most) Office365 applications in the browser.  The shell, also known as the suite header, is shared code that loads as part of almost all Office365 workloads, including SharePoint, OneDrive, Outlook, Yammer, and many more

The other apps can be apps that are registered in Azure AD. For example developers that are creating Apps in connection with Azure AD. Therefore they need to create an app registration. If you go to Azure Active Directory -> App Registrations you get an overview of all registrations that are connected towards your Azure AD tenant.

Betty Stolwyk's avatar
Betty Stolwyk
Brass Contributor
May 12, 2020

JordyBlommaert Would you or anybody know what the application "vortex [wsfed enabled]" is?  It is not a registered application in our tenant.  It has popped up for a couple of our users but they do not know what that is or what they did to cause that sign-in activity.  All the other sign-in information is as expected (IP address, location, browser, OS)

 

Here is a sample entry from the Azure Active Directory Sign-In log:

Application: Vortex [wsfed enabled]
Resource: Windows Azure Active Directory
IP address: xx.xxx.xxx.xx
Location: xxxxxx, xx US
Status: Interrupted
Sign-in error code: 16000
Failure reason: Other
Client app: Unknown
Device ID:
Browser: Chrome 81.0.4044
Operating System: Windows 10
Join Type:
MFA result:
Token issuer type: Azure AD
Conditional access: Not Applied
 
Multiple timestamps very close together.  
 
2020-05-02T01:38:39.466094Z
2020-05-02T01:38:11.9168794Z
2020-05-02T01:38:11.622332Z
2020-05-02T01:38:10.9504493Z
2020-05-02T01:38:09.696237Z
2020-05-02T01:37:30.4821975Z
2020-05-02T01:37:30.247593Z
2020-05-02T01:37:29.7603399Z
 
All other information was the same for each timestamp.

 

Share

Resources