No results when creating alert rule

Kevin Weslowski 0

I've been following this documentation for creating emergency users:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access#monitor-sign-in-and-audit-logs

However, I'm unable to get any results when I'm creating and testing the alert rule.

What am I missing?

Monalla-MSFT 13,031 Reputation points

2024-07-19T14:10:32.6266667+00:00

@Kevin Weslowski - We noticed your feedback that the above answer was not helpful.

Thank you for taking time to share your feedback.

Kindly let us know what we could have done better to improve the answer and make your engagement experience good.

We are here to help you and strive to make your experience better and greatly value your feedback.

Looking forward to your reply. Much appreciate your feedback.
Kevin Weslowski 0 Reputation points

2024-07-19T23:20:21.0666667+00:00

I originally overlooked the pre-requisites that were referenced in the documentation that corresponds to the link from the original post. In hindsight, comments to my original post could have encouraged me to go check my pre-requisites. While I eventually did check my pre-requisites, I spent too much time troubleshooting before checking my pre-requisites.

1 answer

akinbade abiola 18,300 Reputation points

2024-07-04T08:04:42.83+00:00

Hello Kevin Weslowski,

Thanks for your question.

It could be for a number of reasons. For detailed troubleshooting, I would recommend you review the documentation below:

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot

After doing this, proceed to test the steps again on another user.

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola
Please sign in to rate this answer.
Kevin Weslowski 0 Reputation points

2024-07-04T13:12:28.0733333+00:00

The provided link does not relate to my situation. My problem is with the lack of results while testing the query that should generate an alert. The article referenced has information about dealing with problems after the alert has been created.

akinbade abiola 18,300 Reputation points

2024-07-04T15:18:30.6766667+00:00

Okay thanks for clarifying further. What exact query is not returning results? Further details?

Kevin Weslowski 0 Reputation points

2024-07-05T13:40:41.8066667+00:00

I guess the sign in logs weren't getting streamed into the log analytics workspace. Once I explicitly set that up, it started working, albeit not right away (i.e. it started working the next morning).
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Your answer