Azure AD sign-in logs PowerShell

In this article, we will discuss how to get sign-in logs in Azure Active Directory using PowerShell and we will also discuss how to get Azure AD sign-in logs in Azure Portal.

Azure AD sign-in logs PowerShell

Well, we can use the Get-AzureADAuditSignInLogs Azure PowerShell cmdlet to retrieve the sign-in logs in Azure Active Directory.

Get-AzureADAuditSignInLogs

Get-AzureADAuditSignInLogs is an excellent Azure PowerShell cmdlet that can help you to retrieve the sign-in logs in Azure Active Directory. Let’s discuss the syntax of Get-AzureADAuditSignInLogs Azure PowerShell cmdlet with examples.

Syntax

Get-AzureADAuditSignInLogs

If you want to add any filter condition then you can use the syntax like this.

Get-AzureADAuditSignInLogs -Filter "fliter condition as a string"

Example:

Below Azure PowerShell cmdlet will get you the sign-in logs from your Azure Active Directory.

Get-AzureADAuditSignInLogs

After executing the above Azure PowerShell cmdlet, I got the below error

“Get-AzureADAuditSignInLogs : The term ‘Get-AzureADAuditSignInLogs’ is not recognized
as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and
try again.”

Below is the complete error message

Get-AzureADAuditSignInLogs : The term 'Get-AzureADAuditSignInLogs' is not recognized 
as the name of a cmdlet, function, script file, or operable program. Check the 
spelling of the name, or if a path was included, verify that the path is correct and 
try again.
At line:1 char:1
+ Get-AzureADAuditSignInLogs
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-AzureADAuditSignInLogs:String) [], 
    CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

You can see it here.

Solution

To solve this issue, I followed the below steps.

• Uninstall the Azure AD module usig the below PowerShell cmdlet.

Uninstall-Module azuread

Now, install the AzureADPreview module using the below PowerShell cmdlet.

Install-Module AzureADPreview

After installing the AzureADPreview module, I ran the Get-AzureADAuditSignInLogs Azure PowerShell cmdlet again. But this time I got the error

Get-AzureADAuditSignInLogs : You must call the Connect-AzureAD cmdlet before calling
any other cmdlets.

So tried running the Connect-AzureAD followed by Get-AzureADAuditSignInLogs Azure PowerShell cmdlet.

Connect-AzureAD
Get-AzureADAuditSignInLogs

After executing the Get-AzureADAuditSignInLogs, few people are getting the below error and this error becoz, lack of MSGraph permissions.

Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
Code: Authentication_MSGraphPermissionMissing
Message: Calling principal does not have required MSGraph permissions

And the complete error message is

Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
Code: Authentication_MSGraphPermissionMissing
Message: Calling principal does not have required MSGraph permissions
AuditLog.Read.All
InnerError:
RequestId: 51b5d58d-3362-4535-9281-b503783f5647
DateTimeStamp: Fri, 09 Sep 2022 12:06:46 GMT
HttpStatusCode: Forbidden
HttpStatusDescription: Forbidden
HttpResponseStatus: Completed
At line:2 char:1

• Get-AzureADAuditSignInLogs
• ~~~~~~
  • CategoryInfo : NotSpecified: (:) [Get-AzureADAuditSignInLogs], ApiExce
    ption
  • FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsof
    t.Open.MSGraphBeta.PowerShell.GetAuditSignInLogs

You can see it here

If you are getting the above error then follow this article to solve this error.

Azure AD sign-in logs Azure Portal

Well, you can also get the Azure AD sign-in logs in Azure Portal. Follow the below steps

1. Log in to Azure Portal.
2. Search for Azure Active Directory and click on the search result Azure Active Directory.

3. On the Azure Active Directory, click on the Sign-in logs from the left navigation. Click on User sign-ins (interactive) tab. You can filter by last 7 days, last 24 hours, etc.

You may also like following the below articles

• How to get tenant id in Azure using PowerShell
• Get Storage Accounts Azure PowerShell
• How To Secure Azure Function With Azure AD
• How to add bulk guest users in Azure AD B2B from Azure Portal and PowerShell
• What is Azure Active Directory B2B collaboration (Azure AD B2B)
• How to create and add members to Azure Active Directory Group
• How to find deleted users in Azure Active Directory

Final Words

In this article, we discussed how to get sign-in logs in Azure Active Directory using PowerShell and Azure Portal. Thanks for reading this article.