MS Graph: Can Get-MgAuditLogSignIn get non interactive signins information?

Question

I need to track logins, when using Get-MgAuditLogSignIn I only get information about the interactive logins. When trying to filter "isInteractive" as false I get a empty report. Is there a way to get the Non Interactive signins?

Answer 1

Hi @Matheus Sonego ,

Please note that Get-MgAuditLogSignIn MS Graph PowerShell SDK command uses List signIns Graph API in the background. ** Currently this List signIns API retrieves the Azure AD user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.** Hence this List signIns API or MS Graph PowerShell SDK command is not returning non-interactive user signins data.

However upon my further research, there is "Sign-in logs" option available under "Monitoring" section of Azure Active Directory as you can see below and I could see both interactive and non-interactive user signin logs information. Also , we do have the options such as filters and download report in Azure AD portal. You can also review the same and see if it's useful to you.

If the answer is helpful to you, please click "Accept Answer" and kindly upvote it. If you have additional questions about this answer, please click "Comment".

Answer 2

You could use the following....

Connect-MgGraph -Scopes AuditLog.Read.All

Select-MgProfile -Name Beta

$Filter = "(signInEventTypes/any(t: t ne 'interactiveUser'))"

Get-MgAuditLogSignIn -Filter $Filter -all

Answer 3

Hi.

Non-interactive signins are available via the Graph BETA API. They have not yet been published to Graph v1.0

Using the Powershell Graph Module Microsoft.Graph.Users you can retrieve the non-interactive Sign-in via the signinactivity property.

Select-MgProfile beta
Connect-MgGraph -Scopes AuditLog.Read.All, Organization.Read.All
Get-MgUser -UserId {objectid} -Property signinactivity | Select-Object -ExpandProperty SignInActivity

Note: You must use the Azure ObjectID of the account not the UPN.

Answer 4

Hm, so there are no ways to download the non interactive signins from MS Graph? I previously used the Azure Active Directory, but it is limited to 100.000 registers, that gives me only the timespan of one day each time I download the report. I would have to do it too many times, since I need about 3 months of data at least.

Thank you for your help!

Answer 5

I've created PowerShell function Get-AzureAuditAggregatedSignInEvent hosted at https://gist.github.com/ztrhgf/96445c23b25c1682238b8b52e9218430 PS: needs module Microsoft.Graph.Intune to work