API Advanced Hunting IdentityLogonEvents error

mehdi dakhama 336 Reputation points MVP
2023-05-02T13:29:07.31+00:00

Hi everyone,

I'm trying to get the Identitylogonevents result from the API, and I get a forbidden error message, I gave all rights, read all Microsoft documentation and article I found nothing.

i have test all this API :

#$url = "https://api.securitycenter.microsoft.com/api/advancedqueries/run"

#$url = "https://api.security.microsoft.com/api/advancedhunting/run"

#$url = "https://api-eu.securitycenter.microsoft.com/api/advancedhunting/run"

$url= "https://api.security.microsoft.com/api/advancedhunting/run"

this is my query : $query = "IdentityLogonEvents | limit 2"

i can get a result from other table : Alerte, Emailsevents, Deviceevents, devicelogon...

but not Identityeventslogs.

if any one can help me,

thanks

Microsoft Identity Manager
Microsoft Identity Manager
A family of Microsoft products that manage a user's digital identity using identity synchronization, certificate management, and user provisioning.
632 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
165 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
115 questions
{count} votes