Has anything changed in auditLogs or identityRiskEvents endpoints recently?

MMadmin 1 Reputation point
2021-04-02T17:33:47.827+00:00

1) Endpoint: https://graph.microsoft.com/beta/auditLogs/signIns

New users of our app that are verified to have P1 Azure AD license applied to their tenant are giving us the following api response (note: we have not changed our code for making these requests in a very long time),

"Neither tenant is B2C or tenant doesn't have premium license"

I've done the following

  • Verified that the client ID used to generate access token for this call is granted both AuditLog.Read.All and Directory.Read.All permissions
  • Change to v1.0 endpoint (same outcome)
  • Have generated access token using both 'https://login.microsoftonline.com/{tenantDomain}/oauth2/v2.0/token' and 'https://login.microsoftonline.com/{tenantDomain}/oauth2/token' endpoints (same outcome)

My main goal is to exhaust all resources to verify that we are not making these requests incorrectly and get details on any changes to the way these endpoint are to be used. We have advised these customers to contact Microsoft support to ensure there is no issue with their licensing.

2) Endpoint: https://graph.microsoft.com/beta/identityRiskEvents?$top=999

We have been receiving HTTP response code: 400 for these requests on many existing customers, there have been no code changes made on our application.

Want to verify if any changes have been made to this endpoint or the way requests should be formed.

If any additional information is needed please let me know.

Thank you

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,468 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 95,341 Reputation points MVP
    2021-04-02T19:01:06.193+00:00

    It looks like Microsoft is more aggressively enforcing licensing terms across multiple Graph endpoints nowadays, here's a reply given on a similar issue for the credentialUserRegistrationDetails endpoint:

    In general, our licensing team requires that programmatic export of Azure AD data requires P1 or above

    0 comments
  2. MMadmin 1 Reputation point
    2021-04-02T19:30:58.713+00:00

    Thanks for the quick reply @Vasil Michev

    We have verified on each customer that is causing this error response, that they do indeed have Azure AD license level P1 or above. We are able to pull their licenses via API and I have seen on a screen share in their Azure admin portal that it is applied to their tenant.