Unable to send AAD SignIn logs to Log Analytics

Sean Bradley 21 Reputation points

We have Microsoft 365 E3 licenses that include Azure AD Premier P1 access. We also have a "Pay-As-You-Go" Azure subscription for items not covered under that P1 license.

The problem is, we are unable to get the "SighIn" logs from Azure AD to import in to our Log Analytics Workspace. We can get the other logs from AAD (ie: AuditLogs), but not the "SignIn" logs. There is a notice on the bottom of the page saying that we need to have either an AAD P1 or P2 license, which we do have from our M365 E3 licensing.

We contacted our reseller/CSP, and they are trying to tell me there is no problem and nothing they can do, and pushing us to contact Microsoft from our "Pay-As-You-Go" because they say that's where the problem is. That is an additional cost.

I believe the problem actually lies with how our E3 license was handled, as we moved from a bunch of O365 Premium/Standard/Basic licenses to a company wide usage of E3, and because of that, our AAD P1 license is no longer being seen correctly.

Any input would be appreciated. I want to exhaust all options before I call and pay for support.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,067 questions
Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
14,626 questions
0 comments No comments
{count} votes

Accepted answer
  1. Givary-MSFT 14,791 Reputation points Microsoft Employee

    @Sean Bradley

    Apologies for the delay in answering this post.

    I completely agree if you have P1/P2 license you should be able to see sign in logs in your log analytics workspace.

    We have seen similar issue in the past where after considerable delay ( 2 to 3 days ), we were able to see sign in logs in the workspace,

    After reviewing the logs, worked with product group team internally to get the sign in logs ingested to the Log analytics workspace.

    Let me know if you have any further questions.

    Please remember to Accept Answer if answer helped, so that others in the community facing similar issues can easily find the solution.

    0 comments No comments

0 additional answers

Sort by: Most helpful