question

TarasP-5791 avatar image
0 Votes"
TarasP-5791 asked saldana-msft edited

Audit logs with Operation=UserLoginFailed are missing

Hi,

I found an issue:
Audit log is missing on failed user login.
I used to get logs on login failure with Operation=UserLoginFailed via https://compliance.microsoft.com/ or API calls https://manage.office.com/api/v1.0/%s/activity/feed/%s

As of now when I failed login and received log, it looks like login log on success - Operation=UserLoggedIn and ResultStatus=Success.
Please clarify how I can recognise which logs belong to success and which to failure login or what API I should use to get history of failed logins.

Thanks in advance

microsoft-graph-identityazure-ad-audit-logs
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Adding right tags/teams to assist!!

0 Votes 0 ·

1 Answer

MarileeTurscak-MSFT avatar image
0 Votes"
MarileeTurscak-MSFT answered TarasP-5791 commented

Hi @TarasP-5791,

Try going to the Admin Portal > “Security & Compliance” > “Search”>”Audit log search.”

There you should be able to filter by “Activity” = “UserLoginFailed”

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @MarileeTurscak,

Thank you, now it is working

1 Vote 1 ·