Azure AD Sign in Logs

Matt 1 Reputation point
2022-04-29T00:42:16.347+00:00

Just wondering is I can pull any logs for failed user logons at the sign in screen.

Basically I want to know how many people tried to connect that may not have been sync'd to Azure AD yet.

Essentially they wouldn't get past the logon screen and would receive the error
"This username may be incorrect. Make sure that you typed it correctly. Otherwise, contact your admin.

Thanks.

197496-image.png

Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
953 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,566 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. James Hamil 21,851 Reputation points Microsoft Employee
    2022-04-29T01:34:50.36+00:00

    Hi @Matt , you can use the portal to monitor sign ins.

    197490-screenshot-2022-04-28-183314.png

    Please let me know if you have any questions and I can help you further.

    If this answer helped you please mark it as "Verified" so other users can reference it.

    Thank you,
    James

    0 comments
  2. Matt 1 Reputation point
    2022-04-29T01:51:24.677+00:00

    Hi James,

    I have reviewed those logs but I dont think they report failed username attempts. When you first hit the portal page and type an address that doesnt exist in Azure I cant see anywhere that might be reported. If you have a valid username it then moves to the next screen to provide a password then MFA. I believe those are the logs you have directed me to which I can already see.

  3. Matt 1 Reputation point
    2022-04-30T21:26:12.777+00:00

    Yes that's correct. We have had issues with people entering the wrong UPN/Email Address. It has apparently resulted in a large number of calls to our service desk. I'd like to see how many times this could have happened based on actual log data.

    0 comments