Where to Check Application Activity in Azure Log Analytics

Question

Where to Check Application Activity in Azure Log Analytics

Navan Kakwani 0

I have an app registered in Azure with full access to all mailboxes in my tenant. How can I check which mailboxes my app accessed in the last 24 or 48 hours? Is there a table where this information is stored? Note that I am not referring to App Insights.

Abiola Akinbade 29,490 Reputation points Volunteer Moderator

2024-05-20T08:23:16.1533333+00:00
Hello Navan Kakwani,

Thanks for your question.

To check the data you can leverage audit logs, this will give you an idea of the sign-ins in your account.
You can do this by logging into the https://admin.microsoft.com/
See: https://learn.microsoft.com/en-us/purview/audit-search?tabs=microsoft-purview-portal

You can also check the entra ID Logs for Interactive and non interactive sign-ins.

Go to the Azure portal and search for Entra ID or navigate to entra amin center, https://entra.microsoft.com/#home

Scroll to monitoring and select sign in logs

Filter by your app's registration (client ID).

You can also view the audit logs from the monitoring pane.

Please let me know if you have further questions

You can mark it 'Accept Answer' if this helped.
Navan Kakwani 0 Reputation points

2024-05-20T11:09:27.9766667+00:00

Hey Akin,
this doesn't really tell about which users mailbox did the application target. It could give signin logs but nothing's mentioned about how its accessing those mailboxes or what it is doing post accessing it.
Also, AuditLogs is not the right place to look for this info, I can confirm this.

Your answer

Abiola Akinbade 29,490 Reputation points Volunteer Moderator

2024-05-20T08:23:16.1533333+00:00

Hello Navan Kakwani,

Thanks for your question.

To check the data you can leverage audit logs, this will give you an idea of the sign-ins in your account.
You can do this by logging into the https://admin.microsoft.com/
See: https://learn.microsoft.com/en-us/purview/audit-search?tabs=microsoft-purview-portal

You can also check the entra ID Logs for Interactive and non interactive sign-ins.

Go to the Azure portal and search for Entra ID or navigate to entra amin center, https://entra.microsoft.com/#home

Scroll to monitoring and select sign in logs

Filter by your app's registration (client ID).

You can also view the audit logs from the monitoring pane.

Please let me know if you have further questions

You can mark it 'Accept Answer' if this helped.
Navan Kakwani 0 Reputation points

2024-05-20T11:09:27.9766667+00:00

Hey Akin,
this doesn't really tell about which users mailbox did the application target. It could give signin logs but nothing's mentioned about how its accessing those mailboxes or what it is doing post accessing it.
Also, AuditLogs is not the right place to look for this info, I can confirm this.

Share via

Where to Check Application Activity in Azure Log Analytics

Your answer