Entra B2C Audit Logs nearly empty

Question

Entra B2C Audit Logs nearly empty

Max Hay 10

I'm trying to find logs that will tell me when a user's issued an auth token from our application.

Despite myself and a great number of other users actively using the SSO application, the Audit Logs are completely empty save for a few by myself only over the past 2 hours, despite having logged in myself multiple times over the past 7 days.

https://learn.microsoft.com/en-us/azure/active-directory-b2c/view-audit-logs

I've been following this and it suggests that you would be able to view the logs through Home > Azure AD B2C > Audit Logs.

My app registration allows Accounts in any identity provider or organizational directory to access this app. But it should still be issuing tokens.

Why are the B2C audit logs nearly empty?

Anonymous

2025-01-23T19:29:06.7366667+00:00

Hello @Max Hay

Thank you for posting your query on Microsoft Q&A.

B2C tenants only have a 7-day max log retention period - Access and review audit logs - Azure AD B2C | Microsoft Learn

As per the document presently it is in public preview, User sign-ins for individual Azure AD B2C apps aren't visible in the Users section of the Azure portal; audit logs are required to correlate sign-ins with specific apps.

Do you see anything with the filters removed? Also, if you check via PowerShell or Graph API, do you see the same results? https://learn.microsoft.com/en-us/azure/active-directory-b2c/view-audit-logs

Note also that in order to access the audit logs, you need to have one of these roles: Reports Reader; Security Reader; Security Administrator; Global Reader; Global Administrator.

Make sure you are checking under the Azure AD B2C view and not just in the B2C tenant default view. and one more point is that when you go to Users > audit logs > it generally shows empty you have to select a particular user and then see the audit logs and try to not apply any filter.

Audit log for a particular user.

Best regards,Sakshi Devkante
Anonymous

2025-01-23T19:45:06.7066667+00:00

Hello @Max Hay

Thank you for posting your query on Microsoft Q&A.

B2C tenants only have a 7-day max log retention period - Access and review audit logs - Azure AD B2C | Microsoft Learn

As per the document presently it's in public preview. User sign-ins for individual Azure AD B2C apps aren't visible in the Users section of the Azure portal; audit logs are required to correlate sign-ins with specific apps.

Do you see anything with the filters removed? Also, if you check via Powershell or Graph API, do you see the same results? https://learn.microsoft.com/en-us/azure/active-directory-b2c/view-audit-logs

Make sure you are checking under the Azure AD B2C view and not just in the B2C tenant default view.

Note also that in order to access the audit logs, you need to have one of these roles: Reports Reader; Security Reader; Security Administrator; Global Reader; Global Administrator.

and one more point under Users > audit logs > its generally empty logs you need to select a particular user to see their audit logs and try to not add any filters.

after selecting particular user --> go to all users > select a user (ex: Alex) > audit logs then you will see logs and try to remove the filters that are applied.

View audit logs for B2C

Azure AD B2C | What are the sign in logs ?

Best regards,

Sakshi Devkante
Anonymous

2025-01-24T01:43:30.78+00:00

......
Anonymous

2025-01-25T00:37:32.1033333+00:00

Hello @Max Hay

I am following up to see if the suggestion provided above was helpful to you. If you have any further questions or need additional assistance, please don’t hesitate to reach out.

Best regards,

Sakshi Devkante
Anonymous

2025-01-27T14:51:48.9233333+00:00

Hello @Max Hay

I am following up to see if the suggestion provided above was helpful to you. If you have any further questions or need additional assistance, please don’t hesitate to reach out.

Best regards,

Sakshi Devkante