列出 signIn
命名空间：microsoft.graph
重要
Microsoft Graph /beta 版本下的 API 可能会发生更改。 不支持在生产应用程序中使用这些 API。 若要确定 API 是否在 v1.0 中可用，请使用 版本 选择器。
获取 signIn 对象的列表。 该列表包含Microsoft Entra租户的用户登录。 登录，其中用户名和密码作为授权令牌的一部分传递，并且登录日志中当前包含成功的联合登录。
最大和默认页面大小为 1,000 个对象，默认情况下，将首先返回最近的登录。 仅可在默认保留期内发生的Microsoft Entra ID登录事件。
注意
本文介绍如何从设备或服务导出个人数据。 这些步骤可用于支持一般数据保护条例 (GDPR) 下的义务。 授权租户管理员可以在Microsoft Entra ID环境中使用 Microsoft Graph 来更正、更新或删除最终用户的身份信息，包括客户和员工用户配置文件或个人数据，例如用户名、工作职务、地址或电话号码。
此 API 可用于以下国家级云部署。
| 全局服务 | 美国政府 L4 | 美国政府 L5 (DOD) | 由世纪互联运营的中国 |
|---|---|---|---|
| ✅ | ✅ | ✅ | ✅ |
权限
要调用此 API，需要以下权限之一。 若要了解详细信息，包括如何选择权限的信息，请参阅权限。
| 权限类型 | 权限（从最低特权到最高特权） |
|---|---|
| 委派（工作或学校帐户） | AuditLog.Read.All 和 Directory.Read.All |
| 委派（个人 Microsoft 帐户） | 不支持 |
| 应用程序 | AuditLog.Read.All 和 Directory.Read.All |
应用必须正确注册到Microsoft Entra ID。
除了委派的权限外，已登录用户还需要至少属于以下Microsoft Entra角色之一，这些角色允许他们读取登录报告。
- 全局读取者
- 报告读取者
- 安全管理员
- 安全操作员
- 安全信息读取者
在登录中查看应用的条件访问 (CA) 策略
appliedConditionalAccessPolicies 属性中列出的应用 CA 策略仅适用于具有允许他们读取条件访问数据的角色的用户和应用。 如果用户或应用有权读取登录日志，但无权读取条件访问数据，则将省略响应中的 appliedConditionalAccessPolicies 属性。 以下Microsoft Entra角色授予用户查看条件访问数据的权限：
- 全局读取者
- 安全管理员
- 安全信息读取者
- 条件访问管理
应用程序必须至少具有以下权限之一才能在登录日志中查看 appliedConditionalAccessPolicy 对象：
- Policy.Read.All
- Policy.ReadWrite.ConditionalAccess
- Policy.Read.ConditionalAccess
注意：Microsoft Entra具有任何权限的用户都可以读取其用户是执行组件登录的登录日志。 此功能可帮助用户发现其帐户中的意外活动。 用户无法从自己的日志中读取 CA 数据，除非他们具有上面标识的 CA 权限之一。
HTTP 请求
GET /auditLogs/signIns
可选的查询参数
此方法支持 $top、 $skiptoken和 $filter OData 查询参数，以帮助自定义响应。 若要了解一般信息，请参阅 OData 查询参数。
若要避免请求超时，请使用获取所有登录的时间范围应用 $filter 参数，如 示例 1 中所示。
请求标头
| 名称 | 说明 |
|---|---|
| Authorization | 持有者 {token}。 必填。 详细了解 身份验证和授权。 |
请求正文
请勿提供此方法的请求正文。
响应
如果成功，此方法在响应正文中返回 200 OK 响应代码和 signIn 对象集合。 对象的集合根据 createdDateTime 按降序列出。
示例
示例 1：列出特定时间段内的所有登录
在此示例中，响应对象显示用户使用由条件访问策略触发的 MFA 登录，并且主要身份验证方法是通过 FIDO 进行的。
请求
以下示例显示了一个请求。
GET https://graph.microsoft.com/beta/auditLogs/signIns?$filter=createdDateTime ge 2024-07-01T00:00:00Z and createdDateTime le 2024-07-14T23:59:59Z
响应
注意：为了提高可读性，可能缩短了此处显示的响应对象。
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#auditLogs/signIns",
"value": [
{
"id":"1691d37b-8579-43a7-966a-0f35583c1300",
"createdDateTime":"2021-06-30T16:34:32Z",
"userDisplayName":"Test contoso",
"userPrincipalName":"testaccount1@contoso.com",
"userId":"26be570a-1111-5555-b4e2-a37c6808512d",
"appId":"c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
"appDisplayName":"Azure Portal",
"authenticationContextClassReferences": [
{
"id":"C1",
"details":"required"
}
],
"ipAddress":"131.107.159.37",
"clientAppUsed":"Browser",
"clientCredentialType": "certificate",
"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54",
"correlationId":"5d295068-919b-4017-85d8-44be2f5f5483",
"conditionalAccessStatus":"notApplied",
"originalRequestId":"7dccb0d7-1041-4d82-b785-d865272e1400",
"authenticationProtocol": "oAuth2",
"incomingTokenType": "Primary Refresh Token",
"isInteractive":true,
"homeTenantId": "4f7a7bc2-28e2-46a3-b90e-5ade5bc90138",
"homeTenantName": "",
"isTenantRestricted": false,
"tokenIssuerName":"",
"tokenIssuerType":"AzureAD",
"processingTimeInMilliseconds":761,
"riskDetail":"none",
"riskLevelAggregated":"none",
"riskLevelDuringSignIn":"none",
"riskState":"none",
"riskEventTypes_v2":[],
"resourceDisplayName":"Windows Azure Service Management API",
"resourceId":"797f4846-ba00-4fd7-ba43-dac1f8f63013",
"resourceServicePrincipalId": "a6033f22-27f9-45cb-8f63-7dd8a0590e4e",
"resourceTenantId":"99081087-73c4-48d1-a112-f60ff75114f7",
"homeTenantId":"99081087-73c4-48d1-a112-f60ff75114f7",
"authenticationAppDeviceDetails": [],
"authenticationAppPolicyDetails": [],
"authenticationMethodsUsed":[],
"authenticationRequirement":"singleFactorAuthentication",
"azureResourceId": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/testRG/providers/Microsoft.Compute/virtualMachines/testVM",
"federatedCredentialId": "729ab02a-edd5-4ef5-a285-2d91a3c772ab",
"uniqueTokenIdentifier": "ZTE0OTk3YTQtZjg5Mi00YjBiLWIwNTEtZmViZTA1YzJhNDli",
"signInIdentifier":"testaccount1@contoso.com",
"signInEventTypes":["interactiveUser"],
"servicePrincipalId":"",
"sessionLifetimePolicies": [
{
"expirationRequirement": "tenantTokenLifetimePolicy",
"detail": "The user was required to sign in again according to the tenant session lifetime policy"
}
],
"uniqueTokenIdentifier": "ZTE0OTk3YTQtZjg5Mi00YjBiLWIwNTEtZmViZTA1YzJhNDli",
"userType":"member",
"flaggedForReview":false,
"isTenantRestricted":false,
"autonomousSystemNumber":3598,
"crossTenantAccessType":"none",
"status":{
"errorCode":50126,
"failureReason":"Error validating credentials due to invalid username or password.",
"additionalDetails":"The user didn't enter the right credentials. \u00a0It's expected to see some number of these errors in your logs due to users making mistakes."
},
"deviceDetail":{
"deviceId":"",
"displayName":"",
"operatingSystem":"Windows 10",
"browser":"Edge 91.0.864",
"isCompliant":false,
"isManaged":false,
"trustType":""
},
"location":{
"city":"Redmond",
"state":"Washington",
"countryOrRegion":"US",
"geoCoordinates":{
}
},
"appliedConditionalAccessPolicies":[],
"authenticationProcessingDetails":[
{
"key":"Login Hint Present",
"value":"True"
}
],
"managedServiceIdentity":{
"msiType":"systemAssigned",
"associatedResourceId":"/subscriptions/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/resourcegroups/Scenario-TestRPToKeyVaultSAJob_USCentral/providers/Providers.Test/msiStateful/testrp30964",
"federatedTokenId" : "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
"federatedTokenIssuer" : "https://aks_test.prod-aks.azure.com/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/"
},
"networkLocationDetails":[
{
"networkType":"namedNetwork",
"networkNames":["North America"]
}
],
"authenticationDetails":[
{
"authenticationStepDateTime":"2021-06-30T16:34:32Z",
"authenticationMethod":"Password",
"authenticationMethodDetail":"Password in the cloud",
"succeeded":false,
"authenticationStepResultDetail":"Invalid username or password or Invalid on-premise username or password.",
"authenticationStepRequirement":"Primary authentication"
}
],
"authenticationRequirementPolicies":[],
"sessionLifetimePolicies":[]
}
]
}
示例 2：检索以“Azure”开头的 appDisplayName 的前 10 个登录应用
在此示例中，响应对象显示用户仅使用其主要身份验证方法（云密码）登录。 响应包含一个 @odata.nextLink 属性，该属性包含可用于检索接下来 10 个结果的 URL。
请求
GET https://graph.microsoft.com/beta/auditLogs/signins?&$filter=startsWith(appDisplayName,'Azure')&$top=10
响应
注意：为了提高可读性，可能缩短了此处显示的响应对象。
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#auditLogs/signIns",
"@odata.nextLink": "https://graph.microsoft.com/beta/auditLogs/signins?$filter=startsWith(appDisplayName%2c%27Azure%27)&$top=10&$skiptoken=3cff228c89605cc89b0dc753668deef4153e8644caa6d83ed1bb5f711b21cba4",
"value": [
{
"id":"1691d37b-8579-43a7-966a-0f35583c1300",
"createdDateTime":"2021-06-30T16:34:32Z",
"userDisplayName":"Test contoso",
"userPrincipalName":"testaccount1@contoso.com",
"userId":"26be570a-1111-5555-b4e2-a37c6808512d",
"appId":"c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
"appDisplayName":"Azure Portal",
"ipAddress":"131.107.159.37",
"clientAppUsed":"Browser",
"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54",
"correlationId":"5d295068-919b-4017-85d8-44be2f5f5483",
"conditionalAccessStatus":"notApplied",
"homeTenantId": "4f7a7bc2-28e2-46a3-b90e-5ade5bc90138",
"homeTenantName": "",
"isTenantRestricted": false,
"originalRequestId":"7dccb0d7-1041-4d82-b785-d865272e1400",
"isInteractive":true,
"tokenIssuerName":"",
"tokenIssuerType":"AzureAD",
"processingTimeInMilliseconds":761,
"riskDetail":"none",
"riskLevelAggregated":"none",
"riskLevelDuringSignIn":"none",
"riskState":"none",
"riskEventTypes_v2":[],
"resourceDisplayName":"Windows Azure Service Management API",
"resourceId":"797f4846-ba00-4fd7-ba43-dac1f8f63013",
"resourceTenantId":"99081087-73c4-48d1-a112-f60ff75114f7",
"homeTenantId":"99081087-73c4-48d1-a112-f60ff75114f7",
"authenticationAppDeviceDetails": [],
"authenticationAppPolicyDetails": [],
"authenticationMethodsUsed":[],
"authenticationRequirement":"singleFactorAuthentication",
"authenticationProtocol": "oAuth2",
"incomingTokenType": "Primary Refresh Token",
"signInIdentifier":"testaccount1@contoso.com",
"signInEventTypes":["interactiveUser"],
"servicePrincipalId":"",
"userType":"member",
"flaggedForReview":false,
"isTenantRestricted":false,
"autonomousSystemNumber":3598,
"crossTenantAccessType":"none",
"status":{
"errorCode":50126,
"failureReason":"Error validating credentials due to invalid username or password.",
"additionalDetails":"The user didn't enter the right credentials. \u00a0It's expected to see some number of these errors in your logs due to users making mistakes."
},
"uniqueTokenIdentifier": "ZTE0OTk3YTQtZjg5Mi00YjBiLWIwNTEtZmViZTA1YzJhNDli",
"deviceDetail":{
"deviceId":"",
"displayName":"",
"operatingSystem":"Windows 10",
"browser":"Edge 91.0.864",
"isCompliant":false,
"isManaged":false,
"trustType":""
},
"location":{
"city":"Redmond",
"state":"Washington",
"countryOrRegion":"US",
"geoCoordinates":{
}
},
"appliedConditionalAccessPolicies":[],
"authenticationProcessingDetails":[
{
"key":"Login Hint Present",
"value":"True"
}
],
"networkLocationDetails":[
{
"networkType":"namedNetwork",
"networkNames":["North America"]
}
],
"authenticationDetails":[
{
"authenticationStepDateTime":"2021-06-30T16:34:32Z",
"authenticationMethod":"Password",
"authenticationMethodDetail":"Password in the cloud",
"succeeded":false,
"authenticationStepResultDetail":"Invalid username or password or Invalid on-premise username or password.",
"authenticationStepRequirement":"Primary authentication"
}
],
"authenticationRequirementPolicies":[],
"sessionLifetimePolicies":[]
}
]
}
示例 3：检索从最新登录开始的 signInEventType 不交互式的前 10 个登录用户
在此示例中，响应包含一个 @odata.nextLink 属性，该属性包含可用于检索接下来 10 个结果的 URL。
请求
GET https://graph.microsoft.com/beta/auditLogs/signins?&$filter=(signInEventTypes/any(t: t ne 'interactiveUser'))&$orderby=createdDateTime DESC&$top=10
响应
注意：为了提高可读性，可能缩短了此处显示的响应对象。
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#auditLogs/signIns",
"@odata.nextLink": "https://graph.microsoft.com/beta/auditLogs/signins?$filter=(signInEventTypes%2fany(t%3a+t+ne+%27interactiveUser%27))&$top=10&$orderby=createdDateTime+DESC&$skiptoken=186ac5626b89ae2a991ff26b674ac381be50b941a40542cb66f8136f2887275b",
"value": [
{
"id": "ef1e1fcc-80bd-489b-82c5-16ad80770e00",
"createdDateTime": "2022-03-18T18:13:37Z",
"userDisplayName": "MOD Administrator",
"userPrincipalName": "admin@contoso.com",
"userId": "4562bcc8-c436-4f95-b7c0-4f8ce89dca5e",
"appId": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
"appDisplayName": "Graph Explorer",
"ipAddress": "197.178.9.154",
"ipAddressFromResourceProvider": null,
"clientAppUsed": "Browser",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36",
"correlationId": "17b4f05d-3659-42b8-856d-99322911d398",
"conditionalAccessStatus": "notApplied",
"originalRequestId": "",
"isInteractive": false,
"tokenIssuerName": "",
"tokenIssuerType": "AzureAD",
"processingTimeInMilliseconds": 132,
"riskDetail": "none",
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"riskEventTypes_v2": [],
"resourceDisplayName": "Microsoft Graph",
"resourceId": "00000003-0000-0000-c000-000000000000",
"resourceTenantId": "84841066-274d-4ec0-a5c1-276be684bdd3",
"homeTenantId": "84841066-274d-4ec0-a5c1-276be684bdd3",
"homeTenantName": "",
"authenticationAppDeviceDetails": [],
"authenticationAppPolicyDetails": [],
"authenticationMethodsUsed": [],
"authenticationRequirement": "singleFactorAuthentication",
"signInIdentifier": "",
"signInIdentifierType": null,
"servicePrincipalName": "",
"signInEventTypes": [
"nonInteractiveUser"
],
"servicePrincipalId": "",
"federatedCredentialId": "",
"userType": "member",
"flaggedForReview": false,
"isTenantRestricted": false,
"autonomousSystemNumber": 33771,
"crossTenantAccessType": "none",
"servicePrincipalCredentialKeyId": "",
"servicePrincipalCredentialThumbprint": "",
"uniqueTokenIdentifier": "ZWYxZTFmY2MtODBiZC00ODliLTgyYzUtMTZhZDgwNzcwZTAw",
"incomingTokenType": "none",
"authenticationProtocol": "none",
"resourceServicePrincipalId": "943603e4-e787-4fe9-93d1-e30f749aae39",
"mfaDetail": null,
"status": {
"errorCode": 0,
"failureReason": "Other.",
"additionalDetails": null
},
"deviceDetail": {
"deviceId": "eab73519-780d-4d43-be6d-a4a89af2a348",
"displayName": "DESKTOP-LK3PESR",
"operatingSystem": "Windows 10",
"browser": "Chrome 99.0.4844",
"isCompliant": false,
"isManaged": false,
"trustType": "Azure AD registered"
},
"location": {
"city": "Mombasa",
"state": "Coast",
"countryOrRegion": "KE",
"geoCoordinates": {}
},
"appliedConditionalAccessPolicies": [
{
"id": "80290cf6-04c8-4a25-8252-2b4d7d88228a",
"displayName": "Exchange Online Requires Compliant Device",
"enforcedGrantControls": [],
"enforcedSessionControls": [],
"result": "notEnabled",
"conditionsSatisfied": "none",
"conditionsNotSatisfied": "none",
"includeRulesSatisfied": [],
"excludeRulesSatisfied": []
},
{
"id": "a00746d4-8c33-47f7-b120-91936b367a54",
"displayName": "Office 365 App Control",
"enforcedGrantControls": [],
"enforcedSessionControls": [],
"result": "notEnabled",
"conditionsSatisfied": "none",
"conditionsNotSatisfied": "none",
"includeRulesSatisfied": [],
"excludeRulesSatisfied": []
}
],
"authenticationProcessingDetails": [
{
"key": "Root Key Type",
"value": "Unknown"
},
{
"key": "Oauth Scope Info",
"value": "[\"Application.ReadWrite.All\",\"AppRoleAssignment.ReadWrite.All\",\"DelegatedPermissionGrant.ReadWrite.All\",\"Directory.ReadWrite.All\",\"openid\",\"profile\",\"RoleManagement.Read.Directory\",\"User.Read\",\"email\",\"AuditLog.Read.All\"]"
}
],
"networkLocationDetails": [
{
"networkType": "namedNetwork",
"networkNames": [
"Suspicious countries"
]
}
],
"authenticationDetails": [],
"authenticationRequirementPolicies": [],
"sessionLifetimePolicies": [],
"privateLinkDetails": {
"policyId": "",
"policyName": "",
"resourceId": "",
"policyTenantId": ""
}
}
]
}
反馈
即将发布：在整个 2024 年，我们将逐步淘汰作为内容反馈机制的“GitHub 问题”，并将其取代为新的反馈系统。 有关详细信息，请参阅：https://aka.ms/ContentUserFeedback。
提交和查看相关反馈