Get-AzureADAuditSignInLogs inconsistent entries

Question

Get-AzureADAuditSignInLogs inconsistent entries

Dominic.Burns 1

Hi,

I have been using Get-AzureADAuditSignInLogs to retrieve signin log entries and have found that executing the same command multiple times produces varying sets of entries.

e.g.
Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-04-11 and createdDateTime lt 2022-04-12"
=> 124,589
Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-04-11 and createdDateTime lt 2022-04-12"
=> 124,600

There are entries missing/added between the results, not just additional records.

These dates are in the middle of the 30 day window so shouldn't be impacted by recent additions or recent removals.

AzureADPreview version 2.0.2.149

Any insight is appreciated!

Dominic

Shashi Shailaj 7,636 Microsoft Employee Moderator

@Dominic.Burns I tried this and in my test tenant and the count of entries was the same. But I have very less number of entries. In your case it seem to be adding 12 new entries when you run it the second time.

PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count  
15  
  
PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count  
15  
  
PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count  
15  
  
PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count  
15  
  
PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count  
15

When you say "There are entries missing/added between the results, not just additional records." Are you saying that some entries were lost and new ones added when you ran the same command again?

Dominic.Burns 1 Reputation point

2022-05-12T21:35:39.183+00:00

Hi @Shashi Shailaj ,

Yes that is correct. That was my experience. Some entries were lost and new ones added. If I ran the command multiple times the result set would be slightly different each time. Sometimes an entry would appear and other times it would be missing.

Thanks,

Dominic

Your answer

Shashi Shailaj 7,636 Reputation points Microsoft Employee Moderator

2022-05-12T17:18:00.767+00:00

@Dominic.Burns I tried this and in my test tenant and the count of entries was the same. But I have very less number of entries. In your case it seem to be adding 12 new entries when you run it the second time.

PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count 15 PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count 15 PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count 15 PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count 15 PS C:\> (Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-05-01 and createdDateTime lt 2022-05-12").count 15

When you say "There are entries missing/added between the results, not just additional records." Are you saying that some entries were lost and new ones added when you ran the same command again?
Dominic.Burns 1 Reputation point

2022-05-12T21:35:39.183+00:00

Hi @Shashi Shailaj ,

Yes that is correct. That was my experience. Some entries were lost and new ones added. If I ran the command multiple times the result set would be slightly different each time. Sometimes an entry would appear and other times it would be missing.

Thanks,

Dominic

Share via

Get-AzureADAuditSignInLogs inconsistent entries

Your answer