Unable to send AAD SignIn logs to Log Analytics

Question

We have Microsoft 365 E3 licenses that include Azure AD Premier P1 access. We also have a "Pay-As-You-Go" Azure subscription for items not covered under that P1 license.

The problem is, we are unable to get the "SighIn" logs from Azure AD to import in to our Log Analytics Workspace. We can get the other logs from AAD (ie: AuditLogs), but not the "SignIn" logs. There is a notice on the bottom of the page saying that we need to have either an AAD P1 or P2 license, which we do have from our M365 E3 licensing.

We contacted our reseller/CSP, and they are trying to tell me there is no problem and nothing they can do, and pushing us to contact Microsoft from our "Pay-As-You-Go" because they say that's where the problem is. That is an additional cost.

I believe the problem actually lies with how our E3 license was handled, as we moved from a bunch of O365 Premium/Standard/Basic licenses to a company wide usage of E3, and because of that, our AAD P1 license is no longer being seen correctly.

Any input would be appreciated. I want to exhaust all options before I call and pay for support.

Answer 1

@Sean Bradley

Apologies for the delay in answering this post.

I completely agree if you have P1/P2 license you should be able to see sign in logs in your log analytics workspace.

We have seen similar issue in the past where after considerable delay ( 2 to 3 days ), we were able to see sign in logs in the workspace,

After reviewing the logs, worked with product group team internally to get the sign in logs ingested to the Log analytics workspace.

Let me know if you have any further questions.

Please remember to Accept Answer if answer helped, so that others in the community facing similar issues can easily find the solution.