Edit

Share via

AADCustomSecurityAttributeAuditLogs

  • Article

Non-interactive Azure Active Directory sign-in logs from user.

Table attributes

Attribute Value
Resource types -
Categories Audit, Security
Solutions LogManagement
Basic log No
Ingestion-time transformation No
Sample Queries Yes

Columns

Column Type Description
AADOperationType string Type of the operation. Possible values are Add Update Delete and Other.
AADTenantId string ID of the AAD tenant.
ActivityDateTime datetime Date and time the activity was performed in UTC.
ActivityDisplayName string Activity name or the operation name.
AdditionalDetails dynamic Indicates additional details on the activity. Can have any string as a key or value.
_BilledSize real The record size in bytes
CallerIpAddress string IP address of caller.
CorrelationId string ID to provide audit trail.
DurationMs long The duration of the operation in milliseconds.
Id string Unique ID representing the audit activity.
Identity string The identity from the token that was presented when you made the request. It can be a user account, system account, or service principal.
InitiatedBy dynamic User or app initiated the activity.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
Level string The severity level of the event.
Location string The region of the resource emitting the event.
LoggedByService string Service that initiated the activity.
OperationName string Name of the operation.
OperationVersion string The REST API version that's requested by the client.
Result string Result of the activity. Possible values are: success failure timeout unknownFutureValue.
ResultDescription string Provides the error description for the audit operation.
ResultReason string Describes cause of failure or timeout results.
ResultSignature string Contains the error code, if any, for the audit operation.
ResultType string The result of the audit operation can be Success or Failure.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
TargetResources dynamic Indicates information on which resource was changed due to the activity.
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The date and time of the event in UTC.
Type string The name of the table
UserAgent string User agent of initiator.