locked
Azure AD Signin Logs not getting streamed to Log Analytics RRS feed

  • Question

  • Hi folks,

    I can't get the Azure AD sign-in logs to be stored in Log Analytics and therefore cannot see them in Sentinel as well.

    I have Azure AD P1 licenses, my account is a subscription Owner and Global Admin.

    I have tried to enable it through the connector in Sentinel and through the Diagnostic Settings.

    Only the audit data shows up. The signin table does not even get created in Log Analytics.

    Any ideas?

    Cheers

    Monday, June 1, 2020 12:14 AM