{"id":44103,"date":"2023-06-14T10:00:00","date_gmt":"2023-06-14T10:00:00","guid":{"rendered":"https:\/\/infrasos.com\/?p=44103"},"modified":"2023-08-16T12:03:08","modified_gmt":"2023-08-16T12:03:08","slug":"analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity","status":"publish","type":"post","link":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/","title":{"rendered":"Analyze Azure AD Security Logs: Audit &#038; Monitor Azure AD Activity"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"44103\" class=\"elementor elementor-44103\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7c2135a ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7c2135a\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-18fadb6 ot-flex-column-vertical\" data-id=\"18fadb6\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b437233 elementor-widget elementor-widget-text-editor\" data-id=\"b437233\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity. Do you want to enhance your knowledge of using Azure AD security and <a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\">audit logs<\/a> to <a href=\"https:\/\/infrasos.com\/how-to-monitor-azure-ad-activity-for-improved-security\/\">monitor<\/a> and analyze Azure AD activities?\u00a0<\/p><p>This article explains how to utilize each <a href=\"https:\/\/infrasos.com\/how-to-monitor-office-365-activity-logs-for-improved-security\/\">log<\/a> to monitor and review user activities in Azure AD.<\/p><p>The article starts by exploring 4 logs and explaining the information they provide. Then, it discusses the licensing and role prerequisites for utilizing these logs.<\/p><p>Finally there is step-by-step instructions on using the logs for monitoring and analyzing user activities.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4f10156 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4f10156\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-820f9c2 ot-flex-column-vertical\" data-id=\"820f9c2\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3b96cf4 elementor-widget elementor-widget-text-editor\" data-id=\"3b96cf4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-ad-security-best-practices-for-remote-work-2\/\">Azure AD Security Best Practices for Remote Work<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7df65e9 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7df65e9\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-54f3089 ot-flex-column-vertical\" data-id=\"54f3089\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-41a2b1c elementor-widget elementor-widget-heading\" data-id=\"41a2b1c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-large\">Azure AD Security and Audit Logs for Monitoring and Analyzing Activities<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-402164d elementor-widget elementor-widget-text-editor\" data-id=\"402164d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Azure Active Directory provides four logs with various data that organizations need to monitor and analyze user activities in the system. These include <a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\">sign-in<\/a> logs, <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/active-directory\/reports-monitoring\/concept-audit-logs\" target=\"_blank\" rel=\"noopener\">audit<\/a> logs, provisioning logs, and &#8220;usage and insights&#8221; reports.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-2803bf8 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"2803bf8\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-14a8522 ot-flex-column-vertical\" data-id=\"14a8522\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-04dfc4f elementor-widget elementor-widget-heading\" data-id=\"04dfc4f\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Understanding Azure AD Sign-in and Sign-in (preview) Logs <\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fa806ab elementor-widget elementor-widget-text-editor\" data-id=\"fa806ab\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Azure AD<a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\"> sign-in<\/a> logs give organizations powerful insights into how users access and utilize applications and services. This log type is one of the three <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/active-directory\/reports-monitoring\/overview-reports\" target=\"_blank\" rel=\"noopener\">activity logs<\/a>.<\/p><p>IT admins determine user sign-in patterns with the information recorded on the sign-in log. Moreover, this log reveals the number of users that signed in at a particular period.\u00a0Also it displays the status of the sign-ins.\u00a0<\/p><p>As of June 2023, Microsoft released a preview version called &#8220;sign-in logs (preview).&#8221; While the classical sign-in log records interactive user activities, the preview tracks this and 3 additional types of sign-ins (non-interactive users, service principals, and managed identities) for Azure resource sign-ins.\u00a0<\/p><p>Well, interactive sign-in occurs when users access Azure AD with a username and <a href=\"https:\/\/infrasos.com\/how-password-hash-synchronization-works-with-azure-ad-connect\/\">password<\/a> or <a href=\"https:\/\/infrasos.com\/setup-azure-conditional-access-multi-factor-authentication-mfa\/\">MFA<\/a>. On the other hand, non-interactive sign-ins are from applications that sign in on behalf of a user.\u00a0<\/p><p>Furthermore, <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/active-directory\/develop\/app-objects-and-service-principals?tabs=browser\" target=\"_blank\" rel=\"noopener\">service principals<\/a> sign-in on their behalf while <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/active-directory\/managed-identities-azure-resources\/overview\" target=\"_blank\" rel=\"noopener\">managed identities<\/a> sign-in logs record sign-ins from applications with secrets securely stored in <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/key-vault\/general\/overview\" target=\"_blank\" rel=\"noopener\" data-linktype=\"relative-path\">Azure Key Vault<\/a>.<\/p><p>Beyond the &#8220;user&#8221; component, sign-in logs record 3 essential <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/active-directory\/reports-monitoring\/reference-basic-info-sign-in-logs#unique-identifiers\" target=\"_blank\" rel=\"noopener\">components<\/a> when users or applications access an Azure resource. The first critical element is &#8220;<strong>who<\/strong>.&#8221;\u00a0<\/p><p>This record shows the Identity (user) that signed in. The log also records &#8220;<strong>how<\/strong>,&#8221; indicating the client or application used for the sign-in.\u00a0<\/p><p>Finally, you also get &#8220;<strong>what<\/strong>,&#8221; &#8211; which records the target resource accessed by the Identity.\u00a0<\/p><p>So, whenever you<a href=\"https:\/\/infrasos.com\/how-to-secure-your-azure-secrets-and-keys-with-azure-key-vault\/\"> monitor and audit Azure AD security<\/a> activity using sign-in logs, look out for &#8220;who,&#8221; &#8220;how,&#8221; and &#8220;what&#8221; recorded as &#8220;user,&#8221; &#8220;resource,&#8221; and &#8220;application&#8221; or &#8220;client app.&#8221;<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-acb282e ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"acb282e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9f5eb1d ot-flex-column-vertical\" data-id=\"9f5eb1d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-cd7e181 elementor-widget elementor-widget-image\" data-id=\"cd7e181\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQyMjksInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BenVyZS1BRC1TZWN1cml0eS1Mb2dzLWFuZC1BdWRpdC1VbmRlcnN0YW5kaW5nLVNpZ24taW4tYW5kLVNpZ24taW4tcHJldmlldy1Mb2dzLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"439\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs-768x439.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44229\" alt=\"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs-768x439.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs-300x171.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs-1024x585.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs-1536x877.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs-720x411.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs.jpg 1569w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-14bcf77 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"14bcf77\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-e1f9db4 ot-flex-column-vertical\" data-id=\"e1f9db4\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7cc00ec elementor-widget elementor-widget-text-editor\" data-id=\"7cc00ec\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read <a href=\"https:\/\/infrasos.com\/azure-ad-monitoring\/azure-ad-guest-reports-auditing-tool\/\">Use InfraSOS Azure AD Guest Reports &amp; Auditing Tool<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-2e3d4f8 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"2e3d4f8\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ffdd8b5 ot-flex-column-vertical\" data-id=\"ffdd8b5\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-29c693e elementor-widget elementor-widget-heading\" data-id=\"29c693e\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Understanding Azure Active Directory Audit Logs<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e30fe05 elementor-widget elementor-widget-text-editor\" data-id=\"e30fe05\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The audit log is another Azure AD activity log that helps monitor and analyze user actions. Audit log records activities within the directory.<\/p><p>Specifically, the Azure AD audit logs records changes made to <strong>users<\/strong>, <strong>groups<\/strong>, or <strong>applications<\/strong> in the directory. These activity logs are often required for <a href=\"https:\/\/infrasos.com\/gdpr-compliance-checklist-audit-requirements-explained\/\">compliance<\/a> purposes.\u00a0<\/p><p>When organizations monitor Azure AD audit logs, it could reveal security breaches or compliance issues that require fixing.\u00a0<\/p><p>The audit log&#8217;s subject (user, group, or application) is registered as &#8220;Activity Type.&#8221; In addition to the activity type, it also records the &#8220;Category,&#8221; &#8220;Status,&#8221; and the person that initiated the activity, recorded as &#8220;Initiated by (actor).&#8221;<\/p><p>When an audit log is opened, it has three tabs: &#8220;Activity,&#8221; &#8220;Target(s),&#8221; and &#8220;Modified Properties.&#8221;<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3828d30 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"3828d30\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-8619a67 ot-flex-column-vertical\" data-id=\"8619a67\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7766be6 elementor-widget elementor-widget-image\" data-id=\"7766be6\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Understanding Azure AD Audit Logs\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQyODEsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9VbmRlcnN0YW5kaW5nLUF6dXJlLUFELUF1ZGl0LUxvZ3MuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"442\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-768x442.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44281\" alt=\"Understanding Azure AD Audit Logs\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-768x442.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-300x173.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-1024x589.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-1536x884.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-720x414.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs.jpg 1566w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c528705 elementor-widget elementor-widget-text-editor\" data-id=\"c528705\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The Activity tab displays the &#8220;Activity Type,&#8221; which records whether the change was made to a <a href=\"https:\/\/infrasos.com\/office-365-reporting\/office-365-group-reports\/\">group<\/a>, <a href=\"https:\/\/infrasos.com\/office-365-reporting\/office-365-user-reports\/\">user<\/a>, or application. Additionally, the tab records the category of the log and its status.<\/p><p>Also records the &#8220;Initiated by (actor),&#8221; information, which includes the user that made the changes, the IP address, and the UPN of user.\u00a0<\/p><p>The &#8220;Target(s)&#8221; tab records details of the modified object. If available, it records the object&#8217;s name, display name, id, and UPN.<\/p><p>Finally, the &#8220;Modified Properties&#8221; tab shows the properties of the modified object, including the old and new values.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-54b7b69 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"54b7b69\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-8c283b5 ot-flex-column-vertical\" data-id=\"8c283b5\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-77db1c8 elementor-widget elementor-widget-image\" data-id=\"77db1c8\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Audit-Logs.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Azure AD Security Logs and Audit - Understanding Azure AD Audit Logs\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQyOTEsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BenVyZS1BRC1TZWN1cml0eS1Mb2dzLWFuZC1BdWRpdC1VbmRlcnN0YW5kaW5nLUF6dXJlLUFELUF1ZGl0LUxvZ3MuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"441\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Audit-Logs-768x441.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44291\" alt=\"Azure AD Security Logs and Audit - Understanding Azure AD Audit Logs\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Audit-Logs-768x441.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Audit-Logs-300x172.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Audit-Logs-1024x588.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Audit-Logs-1536x883.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Audit-Logs-720x414.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Audit-Logs.jpg 1575w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-14ad33c elementor-widget elementor-widget-image\" data-id=\"14ad33c\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-modified-properties-tab.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Understanding Azure AD Audit Logs - modified properties tab\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQyOTUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9VbmRlcnN0YW5kaW5nLUF6dXJlLUFELUF1ZGl0LUxvZ3MtbW9kaWZpZWQtcHJvcGVydGllcy10YWIuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"443\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-modified-properties-tab-768x443.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44295\" alt=\"Understanding Azure AD Audit Logs - modified properties tab\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-modified-properties-tab-768x443.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-modified-properties-tab-300x173.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-modified-properties-tab-1024x591.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-modified-properties-tab-1536x887.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-modified-properties-tab-720x416.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Understanding-Azure-AD-Audit-Logs-modified-properties-tab.jpg 1564w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d4f0789 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d4f0789\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1411ed7 ot-flex-column-vertical\" data-id=\"1411ed7\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-bd7aac8 elementor-widget elementor-widget-text-editor\" data-id=\"bd7aac8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\">Check Azure AD Audit Logs for User Sign-Ins (Success Failures)<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-91eb02b ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"91eb02b\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b6aef67 ot-flex-column-vertical\" data-id=\"b6aef67\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-04432f1 elementor-widget elementor-widget-heading\" data-id=\"04432f1\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Understanding Azure Active Directory Provisioning Logs<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d54e23a elementor-widget elementor-widget-text-editor\" data-id=\"d54e23a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Azure Active Directory integrates with 3 party applications that <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/active-directory\/app-provisioning\/how-provisioning-works\" target=\"_blank\" rel=\"noopener\">provision users<\/a> in the directory. It records their activities in <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/active-directory\/reports-monitoring\/concept-provisioning-logs\" target=\"_blank\" rel=\"noopener\">provisioning logs<\/a> for IT admins to troubleshoot or track changes these applications make.\u00a0<\/p><p>Regarding records, provisioning logs track information like users successfully created or modified by a 3 party service like ServiceNow. Additionally, it tracks<a href=\"https:\/\/infrasos.com\/active-directory-reporting\/group-reports\/\"> group changes<\/a> and which service made the change.\u00a0<\/p><p>These records help with <a href=\"https:\/\/infrasos.com\/azure-ad-security-best-practices-for-remote-work-2\/\">security<\/a>, <a href=\"https:\/\/infrasos.com\/get-azureadauditsigninlogs-find-sign-in-logs-for-last-30-days-with-powershell\/\">audit<\/a>, and <a href=\"https:\/\/infrasos.com\/azure-security-best-practices-for-compliance-checklist\/\">compliance<\/a> information.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6c294be ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6c294be\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-96eeae8 ot-flex-column-vertical\" data-id=\"96eeae8\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b6c55e9 elementor-widget elementor-widget-text-editor\" data-id=\"b6c55e9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/get-azureadauditsigninlogs-find-sign-in-logs-for-last-30-days-with-powershell\/\">Get-AzureADAuditSignInLogs \u2013 Find Sign In Logs Last 30 Days PowerShell<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-8159970 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"8159970\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-8f12cdc ot-flex-column-vertical\" data-id=\"8f12cdc\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-f7fd18b elementor-widget elementor-widget-heading\" data-id=\"f7fd18b\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Understanding Azure AD \"Usage and insights\" Reports<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b7776c3 elementor-widget elementor-widget-text-editor\" data-id=\"b7776c3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The &#8220;usage and insights&#8221; reports are a central repository where Azure AD records sign-in activities of other Microsoft 365 applications. It is a single location where sign-in activities are viewed.<\/p><p>The page records successful and failed sign-ins, the number of each, and the success rate. Not only those, but it also displays a link to view sign-in activity for each application.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-889ce7e ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"889ce7e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2cbad95 ot-flex-column-vertical\" data-id=\"2cbad95\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c8eab82 elementor-widget elementor-widget-image\" data-id=\"c8eab82\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Usage-and-insights-Reports.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Azure AD Security Logs and Audit - Understanding Azure AD &#039;Usage and insights&#039; Reports\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzMzUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BenVyZS1BRC1TZWN1cml0eS1Mb2dzLWFuZC1BdWRpdC1VbmRlcnN0YW5kaW5nLUF6dXJlLUFELVVzYWdlLWFuZC1pbnNpZ2h0cy1SZXBvcnRzLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"447\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Usage-and-insights-Reports-768x447.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44335\" alt=\"Azure AD Security Logs and Audit - Understanding Azure AD &#039;Usage and insights&#039; Reports\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Usage-and-insights-Reports-768x447.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Usage-and-insights-Reports-300x175.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Usage-and-insights-Reports-1024x596.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Usage-and-insights-Reports-1536x895.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Usage-and-insights-Reports-720x419.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Azure-AD-Usage-and-insights-Reports.jpg 1571w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c25396b elementor-widget elementor-widget-text-editor\" data-id=\"c25396b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>As shown in the screenshot above, the &#8220;usage and insights&#8221; page provides information on the most used applications in an organization, apps with the lowest sign-in success rate, and top sign-in errors.\u00a0<\/p><p>Clicking on the &#8220;view sign in activity&#8221; link for an app displays sign-in errors. Additionally, the details page displays the error codes, occurrences, and the last date the error occurred.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-8b5b7db ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"8b5b7db\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ec33cb4 ot-flex-column-vertical\" data-id=\"ec33cb4\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-f9998f2 elementor-widget elementor-widget-image\" data-id=\"f9998f2\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/sign-in-activity-view-of-an-application-in-the-usage-and-insights-page.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"sign in activity view of an application in the &#039;usage and insights&#039; page\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzMzksInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9zaWduLWluLWFjdGl2aXR5LXZpZXctb2YtYW4tYXBwbGljYXRpb24taW4tdGhlLXVzYWdlLWFuZC1pbnNpZ2h0cy1wYWdlLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"450\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/sign-in-activity-view-of-an-application-in-the-usage-and-insights-page-768x450.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44339\" alt=\"sign in activity view of an application in the &#039;usage and insights&#039; page\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/sign-in-activity-view-of-an-application-in-the-usage-and-insights-page-768x450.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/sign-in-activity-view-of-an-application-in-the-usage-and-insights-page-300x176.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/sign-in-activity-view-of-an-application-in-the-usage-and-insights-page-1024x600.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/sign-in-activity-view-of-an-application-in-the-usage-and-insights-page-1536x900.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/sign-in-activity-view-of-an-application-in-the-usage-and-insights-page-720x422.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/sign-in-activity-view-of-an-application-in-the-usage-and-insights-page.jpg 1563w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a7cb7b6 elementor-widget elementor-widget-text-editor\" data-id=\"a7cb7b6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Before proceeding from &#8220;usage &amp; insights,&#8221; I want to highlight other critical reports here. Earlier, I mentioned that sign-in logs track service principal sign-ins.\u00a0<\/p><p>This information is available in the &#8220;usage &amp; insights&#8221; as &#8220;Service principal sign-in activity (Preview).&#8221; Clicking this displays service principals that Azure Active Directory has authenticated.\u00a0<\/p><p>This report includes the name of the service principal, the last time it signed in, and a link to &#8220;view more details.&#8221;<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b1ce21c ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b1ce21c\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-5f2c51a ot-flex-column-vertical\" data-id=\"5f2c51a\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3da346f elementor-widget elementor-widget-image\" data-id=\"3da346f\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Service-principal-sign-in-activity-Preview-in-usage-insights-reports.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Service principal sign-in activity (Preview) in usage &amp; insights reports\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzNDAsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9TZXJ2aWNlLXByaW5jaXBhbC1zaWduLWluLWFjdGl2aXR5LVByZXZpZXctaW4tdXNhZ2UtaW5zaWdodHMtcmVwb3J0cy5qcGcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"409\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Service-principal-sign-in-activity-Preview-in-usage-insights-reports-768x409.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44340\" alt=\"Service principal sign-in activity (Preview) in usage &amp; insights reports\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Service-principal-sign-in-activity-Preview-in-usage-insights-reports-768x409.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Service-principal-sign-in-activity-Preview-in-usage-insights-reports-300x160.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Service-principal-sign-in-activity-Preview-in-usage-insights-reports-1024x546.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Service-principal-sign-in-activity-Preview-in-usage-insights-reports-1536x819.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Service-principal-sign-in-activity-Preview-in-usage-insights-reports-720x384.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Service-principal-sign-in-activity-Preview-in-usage-insights-reports.jpg 1702w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cbeae53 elementor-widget elementor-widget-text-editor\" data-id=\"cbeae53\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Before we get to that, I like to mention other valuable logs on the &#8220;usage &amp; insights&#8221; page, starting with &#8220;Authentication methods activities.&#8221;\u00a0\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-9467088 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"9467088\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-23411af ot-flex-column-vertical\" data-id=\"23411af\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-534d592 elementor-widget elementor-widget-image\" data-id=\"534d592\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities.-in-Azure-AD-usage-insights-reports.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Authentication methods activities. in Azure AD usage &amp; insights reports\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzNDQsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BdXRoZW50aWNhdGlvbi1tZXRob2RzLWFjdGl2aXRpZXMuLWluLUF6dXJlLUFELXVzYWdlLWluc2lnaHRzLXJlcG9ydHMuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"420\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities.-in-Azure-AD-usage-insights-reports-768x420.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44344\" alt=\"Authentication methods activities. in Azure AD usage &amp; insights reports\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities.-in-Azure-AD-usage-insights-reports-768x420.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities.-in-Azure-AD-usage-insights-reports-300x164.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities.-in-Azure-AD-usage-insights-reports-1024x560.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities.-in-Azure-AD-usage-insights-reports-1536x841.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities.-in-Azure-AD-usage-insights-reports-720x394.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities.-in-Azure-AD-usage-insights-reports.jpg 1692w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b9c27ac elementor-widget elementor-widget-text-editor\" data-id=\"b9c27ac\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/setup-azure-conditional-access-multi-factor-authentication-mfa\/\">Setup Azure Conditional Access + Multi Factor Authentication MFA<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-00485ac elementor-widget elementor-widget-text-editor\" data-id=\"00485ac\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>&#8220;Authentication methods activities&#8221; records <a href=\"https:\/\/infrasos.com\/how-to-enable-mfa-multi-factor-authentication-for-users\/\">authentication methods<\/a> users in an organization use to register in Azure AD.\u00a0<\/p><p>The page has 2 tabs: Registration and Usage. The Registration tab records users signed up for the available authentication methods.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e629d4a ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e629d4a\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-acc7522 ot-flex-column-vertical\" data-id=\"acc7522\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-05aadc0 elementor-widget elementor-widget-image\" data-id=\"05aadc0\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Authentication-methods-activities-Registration-tab.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Azure AD Security Logs and Audit - Authentication methods activities Registration tab\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzNDUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BenVyZS1BRC1TZWN1cml0eS1Mb2dzLWFuZC1BdWRpdC1BdXRoZW50aWNhdGlvbi1tZXRob2RzLWFjdGl2aXRpZXMtUmVnaXN0cmF0aW9uLXRhYi5qcGcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"413\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Authentication-methods-activities-Registration-tab-768x413.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44345\" alt=\"Azure AD Security Logs and Audit - Authentication methods activities Registration tab\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Authentication-methods-activities-Registration-tab-768x413.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Authentication-methods-activities-Registration-tab-300x161.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Authentication-methods-activities-Registration-tab-1024x550.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Authentication-methods-activities-Registration-tab-1536x825.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Authentication-methods-activities-Registration-tab-720x387.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Authentication-methods-activities-Registration-tab.jpg 1696w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7a6141c elementor-widget elementor-widget-text-editor\" data-id=\"7a6141c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>On the other hand, the Usage tab details how the authentication methods has been used.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4112e70 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4112e70\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-e75f4db ot-flex-column-vertical\" data-id=\"e75f4db\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-afa9b7b elementor-widget elementor-widget-image\" data-id=\"afa9b7b\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities-Usage-tab.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Authentication methods activities Usage tab\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzNDYsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BdXRoZW50aWNhdGlvbi1tZXRob2RzLWFjdGl2aXRpZXMtVXNhZ2UtdGFiLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"420\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities-Usage-tab-768x420.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44346\" alt=\"Authentication methods activities Usage tab\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities-Usage-tab-768x420.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities-Usage-tab-300x164.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities-Usage-tab-1024x560.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities-Usage-tab-1536x839.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities-Usage-tab-720x393.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Authentication-methods-activities-Usage-tab.jpg 1689w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a7458c3 elementor-widget elementor-widget-text-editor\" data-id=\"a7458c3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The final log you need in your toolbox is the &#8220;Application credential activity (Preview).&#8221; report. This report provides the last date an application credential was used.\u00a0<\/p><p>Additionally, this report logs the application id, certificate type, and a link to view the record details.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e31fe69 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e31fe69\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-a8806f1 ot-flex-column-vertical\" data-id=\"a8806f1\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-03589d0 elementor-widget elementor-widget-image\" data-id=\"03589d0\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t<figure class=\"wp-caption\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Application-credential-activity-Preview-Microsoft.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Azure AD Security Logs and Audit - Application credential activity (Preview) - Microsoft\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzNTQsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BenVyZS1BRC1TZWN1cml0eS1Mb2dzLWFuZC1BdWRpdC1BcHBsaWNhdGlvbi1jcmVkZW50aWFsLWFjdGl2aXR5LVByZXZpZXctTWljcm9zb2Z0LmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"267\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Application-credential-activity-Preview-Microsoft-768x267.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44354\" alt=\"Azure AD Security Logs and Audit - Application credential activity (Preview) - Microsoft\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Application-credential-activity-Preview-Microsoft-768x267.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Application-credential-activity-Preview-Microsoft-300x104.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Application-credential-activity-Preview-Microsoft-1024x356.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Application-credential-activity-Preview-Microsoft-720x250.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Application-credential-activity-Preview-Microsoft.jpg 1335w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t<figcaption class=\"widget-image-caption wp-caption-text\">image credit: Microsoft<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-4fab9463 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default elementor-invisible\" data-id=\"4fab9463\" data-element_type=\"section\" data-settings=\"{&quot;animation&quot;:&quot;bounceInRight&quot;,&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-70763191 ot-flex-column-vertical\" data-id=\"70763191\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-316bf5af elementor-widget elementor-widget-heading\" data-id=\"316bf5af\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Try our Active Directory & Office 365 Reporting & Auditing Tools<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6a3c2ed9 elementor-widget elementor-widget-text-editor\" data-id=\"6a3c2ed9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #ff6600;\">Try us out<\/span> for <span style=\"color: #ff0000;\">Free<\/span>.\u00a0 100&#8217;s of report templates available. Easily customise your own reports on AD, Azure AD &amp; Office 355.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-4d3a579a ot-flex-column-vertical\" data-id=\"4d3a579a\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-42b7f7df elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"42b7f7df\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor-pro - v3.10.3 - 29-01-2023 *\/\n.elementor-button.elementor-hidden,.elementor-hidden{display:none}.e-form__step{width:100%}.e-form__step:not(.elementor-hidden){display:flex;flex-wrap:wrap}.e-form__buttons{flex-wrap:wrap}.e-form__buttons,.e-form__buttons__wrapper{display:flex}.e-form__indicators{display:flex;justify-content:space-between;align-items:center;flex-wrap:nowrap;font-size:13px;margin-bottom:var(--e-form-steps-indicators-spacing)}.e-form__indicators__indicator{display:flex;flex-direction:column;align-items:center;justify-content:center;flex-basis:0;padding:0 var(--e-form-steps-divider-gap)}.e-form__indicators__indicator__progress{width:100%;position:relative;background-color:var(--e-form-steps-indicator-progress-background-color);border-radius:var(--e-form-steps-indicator-progress-border-radius);overflow:hidden}.e-form__indicators__indicator__progress__meter{width:var(--e-form-steps-indicator-progress-meter-width,0);height:var(--e-form-steps-indicator-progress-height);line-height:var(--e-form-steps-indicator-progress-height);padding-right:15px;border-radius:var(--e-form-steps-indicator-progress-border-radius);background-color:var(--e-form-steps-indicator-progress-color);color:var(--e-form-steps-indicator-progress-meter-color);text-align:right;transition:width .1s linear}.e-form__indicators__indicator:first-child{padding-left:0}.e-form__indicators__indicator:last-child{padding-right:0}.e-form__indicators__indicator--state-inactive{color:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-inactive [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-inactive-secondary-color,#fff)}.e-form__indicators__indicator--state-inactive object,.e-form__indicators__indicator--state-inactive svg{fill:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-active{color:var(--e-form-steps-indicator-active-primary-color,#39b54a);border-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active object,.e-form__indicators__indicator--state-active svg{fill:var(--e-form-steps-indicator-active-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed{color:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator--state-completed [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator__label{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator--shape-none{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a);background-color:initial}.e-form__indicators__indicator--state-completed object,.e-form__indicators__indicator--state-completed svg{fill:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator__icon{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);font-size:var(--e-form-steps-indicator-icon-size);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;overflow:hidden;margin-bottom:10px}.e-form__indicators__indicator__icon img,.e-form__indicators__indicator__icon object,.e-form__indicators__indicator__icon svg{width:var(--e-form-steps-indicator-icon-size);height:auto}.e-form__indicators__indicator__icon .e-font-icon-svg{height:1em}.e-form__indicators__indicator__number{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;margin-bottom:10px}.e-form__indicators__indicator--shape-circle{border-radius:50%}.e-form__indicators__indicator--shape-square{border-radius:0}.e-form__indicators__indicator--shape-rounded{border-radius:5px}.e-form__indicators__indicator--shape-none{border:0}.e-form__indicators__indicator__label{text-align:center}.e-form__indicators__indicator__separator{width:100%;height:var(--e-form-steps-divider-width);background-color:#c2cbd2}.e-form__indicators--type-icon,.e-form__indicators--type-icon_text,.e-form__indicators--type-number,.e-form__indicators--type-number_text{align-items:flex-start}.e-form__indicators--type-icon .e-form__indicators__indicator__separator,.e-form__indicators--type-icon_text .e-form__indicators__indicator__separator,.e-form__indicators--type-number .e-form__indicators__indicator__separator,.e-form__indicators--type-number_text .e-form__indicators__indicator__separator{margin-top:calc(var(--e-form-steps-indicator-padding, 30px) \/ 2 - var(--e-form-steps-divider-width, 1px) \/ 2)}.elementor-field-type-hidden{display:none}.elementor-field-type-html{display:inline-block}.elementor-login .elementor-lost-password,.elementor-login .elementor-remember-me{font-size:.85em}.elementor-field-type-recaptcha_v3 .elementor-field-label{display:none}.elementor-field-type-recaptcha_v3 .grecaptcha-badge{z-index:1}.elementor-button .elementor-form-spinner{order:3}.elementor-form .elementor-button>span{display:flex;justify-content:center;align-items:center}.elementor-form .elementor-button .elementor-button-text{white-space:normal;flex-grow:0}.elementor-form .elementor-button svg{height:auto}.elementor-form .elementor-button .e-font-icon-svg{height:1em}.elementor-select-wrapper .select-caret-down-wrapper{position:absolute;top:50%;transform:translateY(-50%);inset-inline-end:10px;pointer-events:none;font-size:11px}.elementor-select-wrapper .select-caret-down-wrapper svg{display:unset;width:1em;aspect-ratio:unset;fill:currentColor}.elementor-select-wrapper .select-caret-down-wrapper i{font-size:19px;line-height:2}.elementor-select-wrapper.remove-before:before{content:\"\"!important}<\/style>\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"44103\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"42b7f7df\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b34128c ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b34128c\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0d565a0 ot-flex-column-vertical\" data-id=\"0d565a0\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-85ace72 elementor-widget elementor-widget-text-editor\" data-id=\"85ace72\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/office-365-reporting\/office-365-user-reports\/\">Use Office 365 User Reports <\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e252612 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e252612\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-57c85bc ot-flex-column-vertical\" data-id=\"57c85bc\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-f22e9a3 elementor-widget elementor-widget-heading\" data-id=\"f22e9a3\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Monitor and Analyze Azure AD Activity with Azure AD Security & Audit Logs<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bba50ba elementor-widget elementor-widget-text-editor\" data-id=\"bba50ba\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In this section sign in to the Azure portal via <a href=\"https:\/\/portal.azure.com\/\" target=\"_blank\" rel=\"noopener\">portal.azure.com<\/a>. Then, search for and open &#8220;Azure Active Directory.&#8221;\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1c3d92b elementor-widget elementor-widget-image\" data-id=\"1c3d92b\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Open-Azure-Active-Directory-Portal.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Open Azure Active Directory Portal\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzODUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9PcGVuLUF6dXJlLUFjdGl2ZS1EaXJlY3RvcnktUG9ydGFsLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"427\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Open-Azure-Active-Directory-Portal-768x427.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44385\" alt=\"Open Azure Active Directory Portal\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Open-Azure-Active-Directory-Portal-768x427.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Open-Azure-Active-Directory-Portal-300x167.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Open-Azure-Active-Directory-Portal-1024x570.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Open-Azure-Active-Directory-Portal-1536x855.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Open-Azure-Active-Directory-Portal-720x401.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Open-Azure-Active-Directory-Portal.jpg 1648w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b5b9b23 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b5b9b23\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b09d7df ot-flex-column-vertical\" data-id=\"b09d7df\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4764b38 elementor-widget elementor-widget-heading\" data-id=\"4764b38\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Using Sign-in Logs to Monitor and Analyze User Activities<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-47cf94f elementor-widget elementor-widget-text-editor\" data-id=\"47cf94f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To access sign-in logs, open it from the <strong>Monitor<\/strong> menu of the Azure Active Directory portal.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-874aba7 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"874aba7\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6d3e1f5 ot-flex-column-vertical\" data-id=\"6d3e1f5\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a0fefe9 elementor-widget elementor-widget-image\" data-id=\"a0fefe9\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Sign-in-Logs-to-Monitor-and-Analyze-User-Activities.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Using Sign-in Logs to Monitor and Analyze User Activities\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQzOTgsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9Vc2luZy1TaWduLWluLUxvZ3MtdG8tTW9uaXRvci1hbmQtQW5hbHl6ZS1Vc2VyLUFjdGl2aXRpZXMuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"430\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Sign-in-Logs-to-Monitor-and-Analyze-User-Activities-768x430.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44398\" alt=\"Using Sign-in Logs to Monitor and Analyze User Activities\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Sign-in-Logs-to-Monitor-and-Analyze-User-Activities-768x430.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Sign-in-Logs-to-Monitor-and-Analyze-User-Activities-300x168.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Sign-in-Logs-to-Monitor-and-Analyze-User-Activities-1024x573.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Sign-in-Logs-to-Monitor-and-Analyze-User-Activities-1536x859.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Sign-in-Logs-to-Monitor-and-Analyze-User-Activities-720x403.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Sign-in-Logs-to-Monitor-and-Analyze-User-Activities.jpg 1643w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-eaf42af elementor-widget elementor-widget-text-editor\" data-id=\"eaf42af\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>After opening the Azure AD sign-in logs, customize the columns to meet your needs.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-03aa8de ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"03aa8de\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7fff092 ot-flex-column-vertical\" data-id=\"7fff092\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e397d85 elementor-widget elementor-widget-image\" data-id=\"e397d85\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-customize-sign-in-logs-columns.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Azure AD Security Logs and Audit - customize sign-in logs columns\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ0MDUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BenVyZS1BRC1TZWN1cml0eS1Mb2dzLWFuZC1BdWRpdC1jdXN0b21pemUtc2lnbi1pbi1sb2dzLWNvbHVtbnMuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"428\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-customize-sign-in-logs-columns-768x428.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44405\" alt=\"Azure AD Security Logs and Audit - customize sign-in logs columns\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-customize-sign-in-logs-columns-768x428.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-customize-sign-in-logs-columns-300x167.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-customize-sign-in-logs-columns-1024x571.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-customize-sign-in-logs-columns-1536x856.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-customize-sign-in-logs-columns-720x401.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-customize-sign-in-logs-columns.jpg 1650w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bf06f06 elementor-widget elementor-widget-text-editor\" data-id=\"bf06f06\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Then, check the columns you require on the &#8220;Columns&#8221; flyout and uncheck the ones you don&#8217;t. We recommend checking the columns in my screenshot below.\u00a0\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d6be2d9 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d6be2d9\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-bbeb85b ot-flex-column-vertical\" data-id=\"bbeb85b\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ecabe6f elementor-widget elementor-widget-image\" data-id=\"ecabe6f\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Columns-to-show-in-the-Azure-AD-sign-in-logs.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Columns to show in the Azure AD sign-in logs\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ0MTIsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9Db2x1bW5zLXRvLXNob3ctaW4tdGhlLUF6dXJlLUFELXNpZ24taW4tbG9ncy5qcGcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"432\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Columns-to-show-in-the-Azure-AD-sign-in-logs-768x432.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44412\" alt=\"Columns to show in the Azure AD sign-in logs\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Columns-to-show-in-the-Azure-AD-sign-in-logs-768x432.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Columns-to-show-in-the-Azure-AD-sign-in-logs-300x169.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Columns-to-show-in-the-Azure-AD-sign-in-logs-1024x576.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Columns-to-show-in-the-Azure-AD-sign-in-logs-1536x865.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Columns-to-show-in-the-Azure-AD-sign-in-logs-720x405.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Columns-to-show-in-the-Azure-AD-sign-in-logs.jpg 1636w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-80159ba elementor-widget elementor-widget-text-editor\" data-id=\"80159ba\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Add filters to the log after setting the columns to your preference to display the information you want to analyse.\u00a0<\/p><p>To add a filter, click &#8220;Add filters,&#8221; select a filter and click Apply. Repeat this for as many filters as you need.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6d92a65 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6d92a65\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0e0b497 ot-flex-column-vertical\" data-id=\"0e0b497\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-388874a elementor-widget elementor-widget-image\" data-id=\"388874a\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/add-filters-to-Azure-AD-sign-in-logs.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"add filters to Azure AD sign-in logs\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ0MTMsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9hZGQtZmlsdGVycy10by1BenVyZS1BRC1zaWduLWluLWxvZ3MuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"387\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/add-filters-to-Azure-AD-sign-in-logs-768x387.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44413\" alt=\"add filters to Azure AD sign-in logs\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/add-filters-to-Azure-AD-sign-in-logs-768x387.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/add-filters-to-Azure-AD-sign-in-logs-300x151.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/add-filters-to-Azure-AD-sign-in-logs-1024x516.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/add-filters-to-Azure-AD-sign-in-logs-1536x774.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/add-filters-to-Azure-AD-sign-in-logs-720x363.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/add-filters-to-Azure-AD-sign-in-logs.jpg 1805w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-69a740c elementor-widget elementor-widget-text-editor\" data-id=\"69a740c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\">Check Azure AD Audit Logs for User Sign-Ins (Success Failures)<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-19e8dac elementor-widget elementor-widget-text-editor\" data-id=\"19e8dac\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Next, click on a filter and add a condition. In the screenshot below, I have filtered my sign-in logs to return only logs with users containing &#8220;victor.&#8221;<\/p><p>This filtering has reduced the number of logs to what I want to view. Depending on what we troubleshooting, we add additional filters.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-91fff79 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"91fff79\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-e312f33 ot-flex-column-vertical\" data-id=\"e312f33\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e791125 elementor-widget elementor-widget-image\" data-id=\"e791125\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-filter-sign-in-logs.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Azure AD Security Logs and Audit - filter sign-in logs\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ0MjAsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BenVyZS1BRC1TZWN1cml0eS1Mb2dzLWFuZC1BdWRpdC1maWx0ZXItc2lnbi1pbi1sb2dzLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"384\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-filter-sign-in-logs-768x384.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44420\" alt=\"Azure AD Security Logs and Audit - filter sign-in logs\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-filter-sign-in-logs-768x384.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-filter-sign-in-logs-300x150.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-filter-sign-in-logs-1024x512.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-filter-sign-in-logs-1536x768.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-filter-sign-in-logs-720x360.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-filter-sign-in-logs.jpg 1814w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d04866e elementor-widget elementor-widget-text-editor\" data-id=\"d04866e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Opening a log entry provides detailed<a href=\"https:\/\/infrasos.com\/office-365-reporting\/office-365-password-reports\/\"> reports<\/a> about it. The &#8220;Basic info&#8221; tab reveals critical information about the sign-in, like the date, &#8220;Authentication requirement,&#8221; information about the user, the application accessed, and the Sign-in Diagnostic tool.<\/p><p>The Sign-in Diagnostic tool is used to perform additional troubleshooting regarding the sign-in and get recommended actions to fix problems.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3e29178 elementor-widget elementor-widget-image\" data-id=\"3e29178\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-sign-in-logs-details.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Azure AD sign in logs details\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ0NjMsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BenVyZS1BRC1zaWduLWluLWxvZ3MtZGV0YWlscy5qcGcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"442\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-sign-in-logs-details-768x442.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44463\" alt=\"Azure AD sign in logs details\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-sign-in-logs-details-768x442.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-sign-in-logs-details-300x173.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-sign-in-logs-details-1024x590.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-sign-in-logs-details-1536x885.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-sign-in-logs-details-720x415.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-sign-in-logs-details.jpg 1568w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b059d2c elementor-widget elementor-widget-text-editor\" data-id=\"b059d2c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The log entry has other tabs.<\/p><p>Well, the &#8220;Location&#8221; tab records the location and IP address the user attempted authentication from.<\/p><p>The &#8220;Device info&#8221; tab also records the user&#8217;s Operating System, browser, and whether the device is <a href=\"https:\/\/infrasos.com\/office-365-compliance-meet-security-compliance-requirements\/\">compliant<\/a>.\u00a0<\/p><p>Finally, use information in the &#8220;<a href=\"https:\/\/infrasos.com\/azure-ad-conditional-access-implement-access-policies-controls\/\">Conditional Access<\/a>&#8221; and &#8220;Report-only&#8221; tabs to view conditional access and other policies that may or may not have applied to the sign-in.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-de3bf2e ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"de3bf2e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b2ef6c0 ot-flex-column-vertical\" data-id=\"b2ef6c0\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-cebda88 elementor-widget elementor-widget-text-editor\" data-id=\"cebda88\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/how-to-monitor-office-365-activity-logs-for-improved-security\/\">How to Monitor Office 365 Activity Logs for Improved Security<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a5be87a ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a5be87a\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b738303 ot-flex-column-vertical\" data-id=\"b738303\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c5c90ac elementor-widget elementor-widget-heading\" data-id=\"c5c90ac\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Using Azure AD Audit Logs to Analyze User Activities<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-81db12b elementor-widget elementor-widget-text-editor\" data-id=\"81db12b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To open the <a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\">audit log<\/a>, click it in the Azure Active Directory menu.\u00a0<\/p><p>Then, follow the steps described in the last subsection to customize the column to your needs.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-30a9e4e ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"30a9e4e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9291a61 ot-flex-column-vertical\" data-id=\"9291a61\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d26e39f elementor-widget elementor-widget-image\" data-id=\"d26e39f\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Azure-AD-Audit-Logs-to-Analyze-User-Activities.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Using Azure AD Audit Logs to Analyze User Activities\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ0NzMsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9Vc2luZy1BenVyZS1BRC1BdWRpdC1Mb2dzLXRvLUFuYWx5emUtVXNlci1BY3Rpdml0aWVzLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"386\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Azure-AD-Audit-Logs-to-Analyze-User-Activities-768x386.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44473\" alt=\"Using Azure AD Audit Logs to Analyze User Activities\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Azure-AD-Audit-Logs-to-Analyze-User-Activities-768x386.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Azure-AD-Audit-Logs-to-Analyze-User-Activities-300x151.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Azure-AD-Audit-Logs-to-Analyze-User-Activities-1024x515.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Azure-AD-Audit-Logs-to-Analyze-User-Activities-1536x772.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Azure-AD-Audit-Logs-to-Analyze-User-Activities-720x362.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Using-Azure-AD-Audit-Logs-to-Analyze-User-Activities.jpg 1811w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8489160 elementor-widget elementor-widget-text-editor\" data-id=\"8489160\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Similar to sign-in logs, audit logs have filtering capabilities. Fortunately, Microsoft adds the filtering conditions &#8211; <strong>Service<\/strong>, <strong>Activity<\/strong>, and <strong>Category<\/strong> &#8211; you require most.\u00a0<\/p><p>However, the audit log provides the option to add custom filters. To add a filter, click &#8220;Add filters,&#8221; select a filter and click Apply.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1bfd1d8 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1bfd1d8\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-c8ed41a ot-flex-column-vertical\" data-id=\"c8ed41a\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ee76453 elementor-widget elementor-widget-image\" data-id=\"ee76453\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Adding-filters-to-Azure-AD-Audit-Logs.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Adding filters to Azure AD Audit Logs\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ0OTksInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BZGRpbmctZmlsdGVycy10by1BenVyZS1BRC1BdWRpdC1Mb2dzLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"422\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Adding-filters-to-Azure-AD-Audit-Logs-768x422.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44499\" alt=\"Adding filters to Azure AD Audit Logs\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Adding-filters-to-Azure-AD-Audit-Logs-768x422.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Adding-filters-to-Azure-AD-Audit-Logs-300x165.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Adding-filters-to-Azure-AD-Audit-Logs-1024x562.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Adding-filters-to-Azure-AD-Audit-Logs-1536x843.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Adding-filters-to-Azure-AD-Audit-Logs-720x395.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Adding-filters-to-Azure-AD-Audit-Logs.jpg 1678w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-060f4e6 elementor-widget elementor-widget-text-editor\" data-id=\"060f4e6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Once you&#8217;ve added a filter, it is displayed, and use it to determine the results displayed by the audit log. In the screenshot below, I have filtered the log by <strong>Date<\/strong> and\u00a0<strong>Initiated by (actor)<\/strong>.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-75609f7 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"75609f7\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-abb23df ot-flex-column-vertical\" data-id=\"abb23df\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ab2f7ea elementor-widget elementor-widget-image\" data-id=\"ab2f7ea\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Filter-Azure-AD-Audit-log-to-find-Security-threats.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Filter Azure AD Audit log to find Security threats\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ1MDAsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9GaWx0ZXItQXp1cmUtQUQtQXVkaXQtbG9nLXRvLWZpbmQtU2VjdXJpdHktdGhyZWF0cy5qcGcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"418\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Filter-Azure-AD-Audit-log-to-find-Security-threats-768x418.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44500\" alt=\"Filter Azure AD Audit log to find Security threats\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Filter-Azure-AD-Audit-log-to-find-Security-threats-768x418.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Filter-Azure-AD-Audit-log-to-find-Security-threats-300x163.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Filter-Azure-AD-Audit-log-to-find-Security-threats-1024x558.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Filter-Azure-AD-Audit-log-to-find-Security-threats-1536x837.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Filter-Azure-AD-Audit-log-to-find-Security-threats-720x392.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Filter-Azure-AD-Audit-log-to-find-Security-threats.jpg 1670w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3b4ff13 elementor-widget elementor-widget-text-editor\" data-id=\"3b4ff13\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The next step is to drill down by clicking on an entry. Once the log entry opens, review the information in the Activity, Target (s), and &#8220;Modified Properties&#8221; tabs.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e6f4976 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e6f4976\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-5fce1af ot-flex-column-vertical\" data-id=\"5fce1af\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-86a05a2 elementor-widget elementor-widget-image\" data-id=\"86a05a2\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Analyze-an-Azure-AD-audit-log-entry.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Azure AD Security Logs and Audit: How to Monitor and Analyze Azure AD Activity\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NDQ1MDcsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA2XC9BbmFseXplLWFuLUF6dXJlLUFELWF1ZGl0LWxvZy1lbnRyeS5qcGcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"418\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Analyze-an-Azure-AD-audit-log-entry-768x418.jpg\" class=\"attachment-medium_large size-medium_large wp-image-44507\" alt=\"Azure AD Security Logs and Audit: How to Monitor and Analyze Azure AD Activity\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Analyze-an-Azure-AD-audit-log-entry-768x418.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Analyze-an-Azure-AD-audit-log-entry-300x163.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Analyze-an-Azure-AD-audit-log-entry-1024x558.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Analyze-an-Azure-AD-audit-log-entry-1536x837.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Analyze-an-Azure-AD-audit-log-entry-720x392.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Analyze-an-Azure-AD-audit-log-entry.jpg 1672w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2cd0d47 elementor-widget elementor-widget-text-editor\" data-id=\"2cd0d47\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Follow the steps in the last two subsections and the information in previous sections to configure, analyse and monitor provisioning logs and &#8220;Usage and insights&#8221; reports.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-04cfc8c ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"04cfc8c\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-3032dff ot-flex-column-vertical\" data-id=\"3032dff\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a89ca08 elementor-widget elementor-widget-text-editor\" data-id=\"a89ca08\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/how-to-configure-azure-ad-activity-logs-for-effective-monitoring\/\">How to Configure Azure AD Activity Logs for Effective Monitoring<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e9ec1f7 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e9ec1f7\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-a9f02cd ot-flex-column-vertical\" data-id=\"a9f02cd\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7a51a10 elementor-widget elementor-widget-heading\" data-id=\"7a51a10\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Analyze Azure AD Security Logs: Audit & Monitor Azure AD Activity Conclusion<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-380975c elementor-widget elementor-widget-text-editor\" data-id=\"380975c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Monitoring and analyzing audit logs is as crucial as configuring Azure <a href=\"https:\/\/infrasos.com\/azure-ad-identity-protection-detect-respond-to-identity-threats\/\">Identity Protection<\/a>, <a href=\"https:\/\/infrasos.com\/azure-ad-conditional-access-implement-access-policies-controls\/\">Conditional Access<\/a>, Privileged <a href=\"https:\/\/infrasos.com\/azure-ad-privileged-identity-management-manage-monitor-privileged-accounts\/\">Identity Management<\/a>, and other <a href=\"https:\/\/infrasos.com\/how-to-monitor-azure-ad-activity-for-improved-security\/\">security<\/a> features. By analyzing logs in Azure Active Directory, IT admins proactively detect and mitigate potential <a href=\"https:\/\/infrasos.com\/best-practices-for-responding-to-azure-ad-security-incidents\/\">security incidents<\/a>.\u00a0<\/p><p>Fortunately, Azure AD has all the logs required to achieve this goal. Specifically, it offers organizations sign-in, sign-in (preview), and audit logs.<\/p><p>Additionally, this robust cloud <a href=\"https:\/\/infrasos.com\/top-10-best-iam-tools-identity-access-management\/\">identity management<\/a> tool also features provisioning logs and &#8220;usage and insights&#8221; reports.\u00a0These logs provide various data logging to help determine the security health of an Azure AD infrastructure.\u00a0<\/p><p>To help organizations utilize the logs effectively, this article explains the data the Azure AD logs provide and how to use them to monitor and analyze the security posture of Azure AD.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-332e7a80 elementor-section-content-middle ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"332e7a80\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-extended\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-5b0cf3c8 ot-flex-column-vertical\" data-id=\"5b0cf3c8\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ac80e98 elementor-widget elementor-widget-image\" data-id=\"ac80e98\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"113\" height=\"101\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/05\/InfraSOS-Logo-Icon-1.png\" class=\"attachment-full size-full wp-image-5788\" alt=\"InfraSOS-AD-Tools\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-3f4a4f9b ot-flex-column-vertical\" data-id=\"3f4a4f9b\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-192a087b elementor-widget elementor-widget-heading\" data-id=\"192a087b\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Try InfraSOS for FREE<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3d79dbaa elementor-widget elementor-widget-text-editor\" data-id=\"3d79dbaa\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Try InfraSOS Active Directory, Azure AD &amp; Office 365 Reporting &amp; Auditing Tool<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4b0013e5 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"4b0013e5\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"44103\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"4b0013e5\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7fea57e2 elementor-icon-list--layout-inline elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"7fea57e2\" data-element_type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/infrasos.com\/wp-content\/plugins\/elementor\/assets\/css\/widget-icon-list.min.css\">\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-up\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Free 15-Days Trial<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">SaaS AD Reporting & Auditing Solution<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity. Do you want to enhance your knowledge of using Azure AD security and audit logs to monitor and analyze Azure AD activities? This article explains how to utilize each log to monitor and review user activities in Azure AD. The article starts by exploring [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[103,67],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity<\/title>\n<meta name=\"description\" content=\"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity. Do you want to enhance your knowledge of using Azure AD security and audit logs to\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity\" \/>\n<meta property=\"og:description\" content=\"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity. Do you want to enhance your knowledge of using Azure AD security and audit logs to\" \/>\n<meta property=\"og:url\" content=\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\" \/>\n<meta property=\"og:site_name\" content=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infrasos\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-06-14T10:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-08-16T12:03:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs-768x439.jpg\" \/>\n<meta name=\"author\" content=\"Victor Ashiedu\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:site\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Victor Ashiedu\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\"},\"author\":{\"name\":\"Victor Ashiedu\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/c5852885fec0cfbb47020b1f44622ac6\"},\"headline\":\"Analyze Azure AD Security Logs: Audit &#038; Monitor Azure AD Activity\",\"datePublished\":\"2023-06-14T10:00:00+00:00\",\"dateModified\":\"2023-08-16T12:03:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\"},\"wordCount\":1789,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"keywords\":[\"audit log\",\"azure ad\"],\"articleSection\":[\"Azure AD\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\",\"url\":\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\",\"name\":\"Analyze Azure AD Security Logs: Audit & Monitor Azure AD Activity\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/#website\"},\"datePublished\":\"2023-06-14T10:00:00+00:00\",\"dateModified\":\"2023-08-16T12:03:08+00:00\",\"description\":\"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity. Do you want to enhance your knowledge of using Azure AD security and audit logs to\",\"breadcrumb\":{\"@id\":\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/infrasos.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Analyze Azure AD Security Logs: Audit &#038; Monitor Azure AD Activity\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/infrasos.com\/#website\",\"url\":\"https:\/\/infrasos.com\/\",\"name\":\"Active Directory Tools, Report, Monitor &amp; Manage AD\",\"description\":\"Active Directory &amp; Office 365 SaaS Reporting Tool\",\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/infrasos.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/infrasos.com\/#organization\",\"name\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\",\"url\":\"https:\/\/infrasos.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"contentUrl\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"width\":113,\"height\":101,\"caption\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\"},\"image\":{\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/infrasos\/\",\"https:\/\/twitter.com\/infra_sos\",\"https:\/\/www.linkedin.com\/showcase\/86283876\",\"https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/c5852885fec0cfbb47020b1f44622ac6\",\"name\":\"Victor Ashiedu\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8e12582b91f392f24c2b96a724da012a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8e12582b91f392f24c2b96a724da012a?s=96&d=mm&r=g\",\"caption\":\"Victor Ashiedu\"},\"description\":\"Victor is an IT pro based in Manchester, UK. With over 22 years of experience managing Windows Server, Active Directory, and Powershell, and 7 years of expertise in Azure AD and Office 365, he's a seasoned expert in his field. When he's not working, he loves spending time with his family - a wife and a 5-year-old. Victor is passionate about helping businesses succeed in today's fast-changing tech landscape.\",\"sameAs\":[\"https:\/\/www.itechguides.com\/author\/victor-ashiedu\/\",\"https:\/\/www.linkedin.com\/in\/vashiedu\/\"],\"url\":\"https:\/\/infrasos.com\/author\/ashiedu5843\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Analyze Azure AD Security Logs: Audit & Monitor Azure AD Activity","description":"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity. Do you want to enhance your knowledge of using Azure AD security and audit logs to","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/","og_locale":"en_US","og_type":"article","og_title":"Analyze Azure AD Security Logs: Audit & Monitor Azure AD Activity","og_description":"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity. Do you want to enhance your knowledge of using Azure AD security and audit logs to","og_url":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/","og_site_name":"Active Directory Tools, Report, Monitor &amp; Manage AD","article_publisher":"https:\/\/www.facebook.com\/infrasos\/","article_published_time":"2023-06-14T10:00:00+00:00","article_modified_time":"2023-08-16T12:03:08+00:00","og_image":[{"url":"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/06\/Azure-AD-Security-Logs-and-Audit-Understanding-Sign-in-and-Sign-in-preview-Logs-768x439.jpg"}],"author":"Victor Ashiedu","twitter_card":"summary_large_image","twitter_creator":"@infra_sos","twitter_site":"@infra_sos","twitter_misc":{"Written by":"Victor Ashiedu","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/#article","isPartOf":{"@id":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/"},"author":{"name":"Victor Ashiedu","@id":"https:\/\/infrasos.com\/#\/schema\/person\/c5852885fec0cfbb47020b1f44622ac6"},"headline":"Analyze Azure AD Security Logs: Audit &#038; Monitor Azure AD Activity","datePublished":"2023-06-14T10:00:00+00:00","dateModified":"2023-08-16T12:03:08+00:00","mainEntityOfPage":{"@id":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/"},"wordCount":1789,"commentCount":0,"publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"keywords":["audit log","azure ad"],"articleSection":["Azure AD"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/","url":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/","name":"Analyze Azure AD Security Logs: Audit & Monitor Azure AD Activity","isPartOf":{"@id":"https:\/\/infrasos.com\/#website"},"datePublished":"2023-06-14T10:00:00+00:00","dateModified":"2023-08-16T12:03:08+00:00","description":"Analyze Azure AD Security Logs: Audit &amp; Monitor Azure AD Activity. Do you want to enhance your knowledge of using Azure AD security and audit logs to","breadcrumb":{"@id":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/infrasos.com\/"},{"@type":"ListItem","position":2,"name":"Analyze Azure AD Security Logs: Audit &#038; Monitor Azure AD Activity"}]},{"@type":"WebSite","@id":"https:\/\/infrasos.com\/#website","url":"https:\/\/infrasos.com\/","name":"Active Directory Tools, Report, Monitor &amp; Manage AD","description":"Active Directory &amp; Office 365 SaaS Reporting Tool","publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/infrasos.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/infrasos.com\/#organization","name":"InfraSOS - Active Directory & Office 365 Reporting Tools","url":"https:\/\/infrasos.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/","url":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","contentUrl":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","width":113,"height":101,"caption":"InfraSOS - Active Directory & Office 365 Reporting Tools"},"image":{"@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infrasos\/","https:\/\/twitter.com\/infra_sos","https:\/\/www.linkedin.com\/showcase\/86283876","https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg"]},{"@type":"Person","@id":"https:\/\/infrasos.com\/#\/schema\/person\/c5852885fec0cfbb47020b1f44622ac6","name":"Victor Ashiedu","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8e12582b91f392f24c2b96a724da012a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8e12582b91f392f24c2b96a724da012a?s=96&d=mm&r=g","caption":"Victor Ashiedu"},"description":"Victor is an IT pro based in Manchester, UK. With over 22 years of experience managing Windows Server, Active Directory, and Powershell, and 7 years of expertise in Azure AD and Office 365, he's a seasoned expert in his field. When he's not working, he loves spending time with his family - a wife and a 5-year-old. Victor is passionate about helping businesses succeed in today's fast-changing tech landscape.","sameAs":["https:\/\/www.itechguides.com\/author\/victor-ashiedu\/","https:\/\/www.linkedin.com\/in\/vashiedu\/"],"url":"https:\/\/infrasos.com\/author\/ashiedu5843\/"}]}},"_links":{"self":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/44103"}],"collection":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/comments?post=44103"}],"version-history":[{"count":430,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/44103\/revisions"}],"predecessor-version":[{"id":49913,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/44103\/revisions\/49913"}],"wp:attachment":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/media?parent=44103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/categories?post=44103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/tags?post=44103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}