Get-AzureADAuditSignInLogs inconsistent entries

Dominic.Burns 1 Reputation point
2022-05-05T17:05:00.617+00:00

Hi,

I have been using Get-AzureADAuditSignInLogs to retrieve signin log entries and have found that executing the same command multiple times produces varying sets of entries.

e.g.
Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-04-11 and createdDateTime lt 2022-04-12"
=> 124,589
Get-AzureADAuditSignInLogs -All:$true -Filter "createdDateTime gt 2022-04-11 and createdDateTime lt 2022-04-12"
=> 124,600

There are entries missing/added between the results, not just additional records.

These dates are in the middle of the 30 day window so shouldn't be impacted by recent additions or recent removals.

AzureADPreview version 2.0.2.149

Any insight is appreciated!

Dominic

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,450 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,494 questions
{count} votes