Queries for the ACREntraAuthenticationAuditLog table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Microsoft Entra authentication audit log

Logging Microsoft Entra authentication audit events.

source
| project
    TimeGenerated = todatetime(['time']),
    Location = location,
    OperationName = operationName,
    CacheName = tostring(properties.tenant),
    Message = tostring(properties.auditLog.message),
    Authentication = tostring(properties.auditLog.authentication),
    Username = tostring(properties.auditLog.username),
    IpAddress = tostring(properties.auditLog.ipAddress),
    ClientId = tostring(properties.auditLog.clientId),
    ClientName = tostring(properties.auditLog.clientName),
    Lifetime = tostring(properties.auditLog.lifeTime),
    RoleInstance = toint(properties.roleInstance)