In the Diagnostics settings blade, select SignInLogs

To create a new export, use Diagnostics settings | Add diagnostic setting If nothing is entered, and you do not export the sign-in and audit logs, the data will be lost after 30 days. In the best case, you will already see an entry for a Log Analytics workspace that you can use.

If you see one or more export settings, check where the logfiles flow. In the top menu below Export Data SettingsĪre the previous settings for log export. You will find the familiar overview of all sign-ins to your Azure directory. On the AAD portal in Azure Active Directory | Sign-ins īefore you use the data and create colorful dashboards, though, it's worth taking a look at the export settings in AAD, because data can only be found if it is exported. The SQL-style search language makes it easy to find what you are looking for, so you have few excuses for not investigating the features. The system scans the acquired logs, supporting ad hoc searches and the creation of custom dashboards. That situation should now be a thing of the past, because the log export functions in AAD, along with Log Analytics, allow flexibility and granular insights. In most cases, they do not have enough time, changes are too costly, or transparency is lacking about what kind of data is available. Often, identity admins do not receive their own dashboards in the SIEM system. Checking the Export SettingsĪlthough SIEM is designed to be the data sink for analysts and security officers, the dashboards, alerts, and insights are not always suitable for those responsible for identity, single sign-on, application integration, and Office 365. In this article, I show you how to create your own dashboards in the AAD portal with the data from exported logs. Additionally, identity administrators have their own complex requirements and questions regarding audit and logon. The retention of data within AAD is limited to 30 days, so exporting protects against the loss of historical data. Exporting the logs is not only exciting for the security information and event management (SIEM) team dealing with security analyses and incidents, but also for AAD admins. The portal lets you export to the three Azure-based data sinks – Blob Storage, Event Hub, and Log Analytics – each of which is designed for different use cases. For some time now, Azure Active Directory (AAD) has been able to export sign-in and audit log data.

Aad logs