Capturing Failed logins using MS Identity Web and OpenIDConnect

Question

User2054207217 posted

Hi All,

I have a working web application that implements Single Sign On using Azure AD using OpenID Connect. I am trying to determine the best way to capture failed or unsuccessful login attempts. Is this possible? As I understand, as my application hands off the authentication to Azure Identity Web, my app. would not know of a failed attempt, correct?

Thanks.

Answer 1

User-1330468790 posted

Hi progdever,

 

If you hands over the authentication to Azure Identity Web, you could monitor the sign-in activities in Azure portal. 

It will provide you with a Sign-ins report which shows up below information for each sign-in log:

• The sign-in date
• The related user
• The application the user has signed in to
• The sign-in status
• The status of the risk detection
• The status of the multi-factor authentication (MFA) requirement

If you want to check the failed login attempts, simply select Failure from the Status drop-down to display only the failed sign-ins.

 

More details, you could refer to below guides:

How to: Troubleshoot sign-in errors using Azure Active Directory reports

Sign-in activity reports in the Azure Active Directory portal

 

Hope this can help you.

Best regards,

Sean

Answer 2

User2054207217 posted

Sean,

Thanks. But is there a way to capture the failed logins from the web app itself?

Answer 3

User475983607 posted

But is there a way to capture the failed logins from the web app itself?

The main reason to implement an external login is so you application does not manage accounts or ever see the user's credentials.    

Why do you need this information?  Reporting?

Answer 4

User2054207217 posted

Yes mostly for auditing. Thanks.

Answer 5

User-1330468790 posted

Hi progdever,

 

Obviously you could not directly monitor those sign-in activities from your web project.

However, there is a workaround using Activity reports API to fetch such information by calling Activity reports API .

It includes two kinds of logs:

• audit logs => answers following questions:
  1. Who granted admin group access to a directory user?
  2. Which users are signing in to a recently acquired app?
  3. How many passwords resets were made within the directory?
• sign-in logs => answers following questions: 
  1. What is the sign in pattern of a user?
  2. How many users have signed in during the last week?
  3. What's the status of these sign-ins?

More information, you could refer to this link: Activity reports API overview 

Please note that requests sent to the Graph API must be well-formed, target a valid endpoint and version of the Graph API, and carry a valid access token obtained from Azure AD in their Authorization header.

 

Best regards,

Sean