Microsoft Entra Id - Sign In Log API

Ron Weasley 0 Reputation points
2024-05-28T08:07:19.84+00:00

Hello Team,

We could see there are four types of Sign-in logs as per https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins?source=recommendations#what-are-the-types-of-sign-in-logs.

Is Sign-in API return all these type of logs ? Or do we have any other APIs to pull the different category sign-in logs? Could you please let us know.

Sign-in API reference : https://learn.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-1.0&tabs=http

Thanks,
Ravi P.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,127 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Vasil Michev 98,201 Reputation points MVP
    2024-05-28T15:44:13.6633333+00:00

    You can use the signin API, however via the /beta endpoint. You can find some examples therein as well: https://learn.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-beta&tabs=http#example-3-retrieve-the-first-10-sign-ins-where-the-signineventtype-isnt-interactiveuser-starting-with-the-latest-sign-in

    Unfortunately, currently there seems to be an issue with the nonInteractiveUser category, but hopefully Microsoft will fix it in the coming days. You can still query other types:

    GET https://graph.microsoft.com/beta/auditLogs/signins?&$filter=(signInEventTypes/any(t:t eq 'servicePrincipal'))&$top=10
    
    0 comments No comments