o365 login attempts to Sentinel SIEM

Anonymous
2021-03-17T14:51:56.593+00:00

Using a KQL query how would someone pull login attempts to o365 from a user using the Sentinel SIEM? Logging in from the outside of an org into the Office.com portal?

I know the logs or login events are captured on MCAS - but id want to see more details in Sentinel.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
973 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. VipulSparsh-MSFT 16,231 Reputation points Microsoft Employee
    2021-03-19T15:02:45.173+00:00

    Thanks for reaching out. You would need to add the Azure active directory connector in Azure Sentinel workspace. We collect the sign in Info in AAD logs.

    79666-image.png

    Once the logs are ingested which can take some time, there are inbuilt queries which you can modify to get just the office 365 portal logs.
    That is denoted as Microsoft Office 365 Portal in Sign in reports.

    So you can run a basic query which as basic as

    SigninLogs
    | where AppDisplayName == "Microsoft Office 365 Portal"
    | take 100

    Which will take the result from sign in logs table and show top 100 results. The query can be modified to any specific UPN, location or device as per need.
    You can check few of the templates in AAD connector which has lots of sample queries inbuilt.

    0 comments