SigninLogs in Log Analytics Workspace Not Showing

Joey Marshall 41 Reputation points
2024-04-12T18:27:55.3533333+00:00

I'm following https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access and have set everything up, however, when I run the query searching for 7 days (tried both UserID and UPN), it does not show any results even though when I go to the accounts page to confirm I had a sign in within the last 7 days. Am I missing something?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,804 questions
Accepted answer
  1. AnuragSingh-MSFT 20,016 Reputation points
    2024-04-29T08:08:41.7266667+00:00

    @Joey Marshall, thank you for posting this question on Microsoft Q&A and apologies for the delayed response.

    The primary reason for this issue is that the Diagnostic Settings was not enabled to forward MIcrosoft Entra logs to Log Analytics workspace, as mentioned in the prerequisite - Send Microsoft Entra sign-in logs to Azure Monitor.

    I would suggest following the steps and ensuring that the diagnostic logs are enabled.

    In case this was already followed, and you are still not able to see any logs flowing into the LA workspace, I would request opening a support case with Azure, so that the backend logs can be reviewed to understand the reason for this issue.

    Hope this helps.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest