Share via

Azure Authentication methods activity logs

Bombbe 1,421 Reputation points
2023-01-11T08:08:45.2466667+00:00

Azure AD Usage & insights provides the Authentication methods activity report, which breaks down authentication by the method used as following

User's image

My question is this report also possible to query from AAD Logs that are located in Log Analytics (so it could be pinned to dashboard)? If yes, which table they are collected and would someone have maybe example query available? I have now several hours tried but failed every time.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,899 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 34,891 Reputation points Microsoft Employee
    2023-01-12T06:27:46.32+00:00

    @Bombbe Thank you for reaching out to us, As I understand you are looking for query which can help you to display information related to Authentication methods (as shown in the above screenshot) from the logs which are stored in log analytics workspace.

    Yes, we do have a workbook Authentication prompts analysis workbook (has all the detailed information) which will review information based on Method, Device state, Application, User, Status, OS, Process details and Policy.

    Let me know if you have any further questions, feel free to post back.

    Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.