Azure Authentication methods activity logs

asked 2023-01-11T08:08:45.2466667+00:00
Bombbe 1,466 Reputation points

Azure AD Usage & insights provides the Authentication methods activity report, which breaks down authentication by the method used as following

User's image

My question is this report also possible to query from AAD Logs that are located in Log Analytics (so it could be pinned to dashboard)? If yes, which table they are collected and would someone have maybe example query available? I have now several hours tried but failed every time.

Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
12,568 questions
{count} votes

1 answer

Sort by: Most helpful
  1. answered 2023-01-12T06:27:46.32+00:00
    Givary-MSFT 11,336 Reputation points Microsoft Employee

    @Bombbe Thank you for reaching out to us, As I understand you are looking for query which can help you to display information related to Authentication methods (as shown in the above screenshot) from the logs which are stored in log analytics workspace.

    Yes, we do have a workbook Authentication prompts analysis workbook (has all the detailed information) which will review information based on Method, Device state, Application, User, Status, OS, Process details and Policy.

    Let me know if you have any further questions, feel free to post back.

    Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

    No comments