question

Matt-7099 avatar image
0 Votes"
Matt-7099 asked Matt-7099 answered

Azure AD Sign in Logs

Just wondering is I can pull any logs for failed user logons at the sign in screen.

Basically I want to know how many people tried to connect that may not have been sync'd to Azure AD yet.

Essentially they wouldn't get past the logon screen and would receive the error
"This username may be incorrect. Make sure that you typed it correctly. Otherwise, contact your admin.

Thanks.

197496-image.png


azure-ad-sign-in-logs
image.png (9.7 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JamesHamil-MSFT avatar image
0 Votes"
JamesHamil-MSFT answered

Hi @Matt-7099 , you can use the portal to monitor sign ins.

197490-screenshot-2022-04-28-183314.png

Please let me know if you have any questions and I can help you further.

If this answer helped you please mark it as "Verified" so other users can reference it.

Thank you,
James



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Matt-7099 avatar image
0 Votes"
Matt-7099 answered JamesHamil-MSFT commented

Hi James,

I have reviewed those logs but I dont think they report failed username attempts. When you first hit the portal page and type an address that doesnt exist in Azure I cant see anywhere that might be reported. If you have a valid username it then moves to the next screen to provide a password then MFA. I believe those are the logs you have directed me to which I can already see.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hey @Matt-7099 , sorry for the misunderstanding! Just so I'm clear, you want to know when the user enters a username that doesn't currently exist?

0 Votes 0 ·
Matt-7099 avatar image
0 Votes"
Matt-7099 answered

Yes that's correct. We have had issues with people entering the wrong UPN/Email Address. It has apparently resulted in a large number of calls to our service desk. I'd like to see how many times this could have happened based on actual log data.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.