User Sign-in Authentication Failure Dashboard Creation In Azure

Question

Hi All:

Please find out the Queries and try to help me with these Issues, If Anyone helps me out it's very much appreciated.

Objective:

Need to Create Dashboard for particular User's Sign-in Authentication Failure in Azure

Ex: 5 user's Sign-in Authentication Failure in one dashboard.

Please, anyone, solve these steps to create the dashboard for 5 users in one dashboard.

Detailed Authentication Information

1. Log details – name, source, and other log information.
2. Subject – account name, domain, and security information about the logon.
3. Logon type – the method used to log on, such as using the local or remote keyboard (over the network). This field value is expressed as an integer, the most common being 2 (local keyboard) and 3 (network).
4. Account for Which Logon Failed – name, domain, and other details for the failed login.
5. Failure Information – failure reason and status of the attempt.
6. Process Information – name and ID of the originating process.
7. Network Information – name, IP address, and port where the remote logon request originated. These values are left blank for local logins, or if the information can’t be found.
8. Detailed Authentication Information – details about this specific logon request.

Best Regards,
Nirmal Manoharan

Answer 1

You can use Azure Log Analytics to build your own custom dashboard with queries, filters, and views of all of the things you described.

There are also pre-built dashboards that you can use to plug into your existing data.

Then you should be able to filter by those UPNs to view the information for the five users.

Another great option Power BI user activity tracking through the activity log and the unified audit log. Power BI audit log search allows you to search for activities done by specific users.

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting