Managed identity Azure Active Directory sign-in logs.

Table attributes

Attribute Value
Resource types -
Categories Audit, Security
Solutions LogManagement
Basic log No
Ingestion-time transformation Yes
Sample Queries Yes


Column Type Description
AppId string Unique GUID representing the app ID in the Azure Active Directory
AuthenticationContextClassReferences string The authentication contexts of the sign-in
AuthenticationProcessingDetails string Provides the details associated with authentication processor
_BilledSize real The record size in bytes
Category string Category of the sign-in event
ConditionalAccessPolicies string Details of the conditional access policies being applied for the sign-in
ConditionalAccessStatus string Status of all the conditionalAccess policies related to the sign-in
CorrelationId string ID to provide sign-in trail
DurationMs long The duration of the operation in milliseconds
FederatedCredentialId string Th identifier of an application's federated identity credential if a federated identity credential was used to sign in.
Id string Unique ID representing the sign-in activity
Identity string The identity from the token that was presented when you made the request. It can be a user account, system account, or service principal
IPAddress string IP address of the client used to sign in
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
Level string The severity level of the event
Location string The region of the resource emitting the event
LocationDetails string Details of the sign-in location
OperationName string For sign-ins, this value is always Sign-in activity
OperationVersion string The REST API version that's requested by the client
ResourceDisplayName string Name of the resource that the service principal signed into
ResourceGroup string Resource group for the logs
ResourceIdentity string ID of the resource that the service principal signed into
ResourceServicePrincipalId string Service Principal Id of the resource
ResultDescription string Provides the error description for the sign-in operation
ResultSignature string Contains the error code, if any, for the sign-in operation
ResultType string The result of the sign-in operation can be Success or Failure
ServicePrincipalCredentialKeyId string Key id of the service principal that initiated the sign-in
ServicePrincipalCredentialThumbprint string Thumbprint of the service principal that initiated the sign-in
ServicePrincipalId string ID of the service principal who initiated the sign-in
ServicePrincipalName string Service Principal Name of the service principal who initiated the sign-in
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The date and time of the event in UTC
Type string The name of the table
UniqueTokenIdentifier string Unique token identifier for the request