This post has been republished via RSS; it originally appeared at: Azure Active Directory Identity Blog articles.
Today, I am excited to announce that the integration of Azure AD Activity Logs with Azure Monitor is now generally available in the public cloud. This is one of our customers top requested features and when we announced the public preview of Azure AD Logs in Log Analytics a few months back, there was a lot of excitement around it.
Here’s what one customer had to say about the feature:
“I think we’re only beginning to scrape the surface of what’s possible with Log Analytics. So far, Log Analytics has proven very useful to analyze past traffic to help us shape our future conditional access policies. Perhaps the biggest challenge is unleashing your mind to imagine and explore of the cool stuff we could be doing with this.” — Associate director of IT Architecture at a research company.
Over the past few months, many of our customers have leveraged the Azure Monitor features including Log Analytics and provided valuable feedback on how to make it better. We listened to your feedback and made it easier for you to get the visualizations you need about Azure AD Activity logs.
The newly released Insights feature helps you easily gain insights into your Azure AD resources using our pre-built interactive templates, called Workbooks in Log Analytics. These pre-built templatized reports give you a lens into various aspects of Azure AD instances.
Here are a few pre-built Workbooks:
- Sign-ins: Provides sign-in insights for apps and users including, sign-in location, OS or browser client/version used, and number of successful and failed sign-ins.
- Legacy authentication and conditional access: Provides insights into users or apps using legacy authentications in your tenant. Helps you understand MFA usage triggered by conditional access policies, apps using conditional access policies etc.
- Sign-in failure analysis: Troubleshoot sign-ins and identify the top sign-in errors in your organization. Using this information, you can determine if the error occurred due to a user action, policy issues, or infrastructure.
In addition to these Workbooks, you can create your own reports using the Azure AD Logs by clicking the New button at the top. You can also edit the pre-built Workbooks to customize for your needs.
Get Started
To get started, simply go to the Insights page within Azure AD where you can access the Insights gallery and pre-built Workbooks. Learn more about Azure AD Workbooks and how to create, edit, and clone them.
Next Steps
If you are using Azure Monitor for the first time, check out the cool demo video on how to maximize your integration story. You can also find reference documentation on how to install our pre-build views. If you want to integrate Azure AD Logs with your SIEM tools, check out the integration docs with Sumologic, ArcSight, and Splunk. In addition, check out the recently published blog around how to interpret the Azure AD logs.
Learn more about Azure AD Workbooks and how to create, edit and make them your own As always, we'd love to receive any suggestions or feedback you have, so please comment below or on the Azure AD feedback forum.
Best regards,
Alex Simons (@Alex_A_Simons)
Corporate VP of Program Management
Microsoft Identity Division