Skip to content
Azure Lessons
Azure Lessons
  • Home
  • AWS
  • Azure VM
  • Azure AD
  • Azure tutorial
    • Azure Cognitive Services
    • Azure Machine Learning
    • Azure DevOps

Azure AD sign-in logs PowerShell

September 10, 2022 by Rajkishore
Azure AD sign-in logs PowerShell

In this article, we will discuss how to get sign-in logs in Azure Active Directory using PowerShell and we will also discuss how to get Azure AD sign-in logs in Azure Portal.

Table of Contents

  • Azure AD sign-in logs PowerShell
  • Get-AzureADAuditSignInLogs
    • Syntax
    • Example:
  • Azure AD sign-in logs Azure Portal
  • Final Words

Azure AD sign-in logs PowerShell

Well, we can use the Get-AzureADAuditSignInLogs Azure PowerShell cmdlet to retrieve the sign-in logs in Azure Active Directory.

Get-AzureADAuditSignInLogs

Get-AzureADAuditSignInLogs is an excellent Azure PowerShell cmdlet that can help you to retrieve the sign-in logs in Azure Active Directory. Let’s discuss the syntax of Get-AzureADAuditSignInLogs Azure PowerShell cmdlet with examples.

Syntax

Get-AzureADAuditSignInLogs

If you want to add any filter condition then you can use the syntax like this.

Get-AzureADAuditSignInLogs -Filter "fliter condition as a string"

Example:

Below Azure PowerShell cmdlet will get you the sign-in logs from your Azure Active Directory.

Get-AzureADAuditSignInLogs

After executing the above Azure PowerShell cmdlet, I got the below error

“Get-AzureADAuditSignInLogs : The term ‘Get-AzureADAuditSignInLogs’ is not recognized
as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and
try again.”

Below is the complete error message

Get-AzureADAuditSignInLogs : The term 'Get-AzureADAuditSignInLogs' is not recognized 
as the name of a cmdlet, function, script file, or operable program. Check the 
spelling of the name, or if a path was included, verify that the path is correct and 
try again.
At line:1 char:1
+ Get-AzureADAuditSignInLogs
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-AzureADAuditSignInLogs:String) [], 
    CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

You can see it here.

The term 'Get-AzureADAuditSignInLogs' is not recognized

Solution

To solve this issue, I followed the below steps.

  • Uninstall the Azure AD module usig the below PowerShell cmdlet.
Uninstall-Module azuread

Now, install the AzureADPreview module using the below PowerShell cmdlet.

Install-Module AzureADPreview
Get -AzureADAuditSignInLogs is not recognized

After installing the AzureADPreview module, I ran the Get-AzureADAuditSignInLogs Azure PowerShell cmdlet again. But this time I got the error

Get-AzureADAuditSignInLogs : You must call the Connect-AzureAD cmdlet before calling
any other cmdlets.

You must call the Connect AzureAD cmdlet

So tried running the Connect-AzureAD followed by Get-AzureADAuditSignInLogs Azure PowerShell cmdlet.

Connect-AzureAD
Get-AzureADAuditSignInLogs

After executing the Get-AzureADAuditSignInLogs, few people are getting the below error and this error becoz, lack of MSGraph permissions.

Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
Code: Authentication_MSGraphPermissionMissing
Message: Calling principal does not have required MSGraph permissions

And the complete error message is

Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
Code: Authentication_MSGraphPermissionMissing
Message: Calling principal does not have required MSGraph permissions
AuditLog.Read.All
InnerError:
RequestId: 51b5d58d-3362-4535-9281-b503783f5647
DateTimeStamp: Fri, 09 Sep 2022 12:06:46 GMT
HttpStatusCode: Forbidden
HttpStatusDescription: Forbidden
HttpResponseStatus: Completed
At line:2 char:1

  • Get-AzureADAuditSignInLogs
  • ~~~~~~
    • CategoryInfo : NotSpecified: (:) [Get-AzureADAuditSignInLogs], ApiExce
      ption
    • FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsof
      t.Open.MSGraphBeta.PowerShell.GetAuditSignInLogs

You can see it here

Calling principal does not have required MSGraph permissions

If you are getting the above error then follow this article to solve this error.

Azure AD sign-in logs Azure Portal

Well, you can also get the Azure AD sign-in logs in Azure Portal. Follow the below steps

  1. Log in to Azure Portal.
  2. Search for Azure Active Directory and click on the search result Azure Active Directory.
how to get the Azure AD sign-in logs in Azure Portal

3. On the Azure Active Directory, click on the Sign-in logs from the left navigation. Click on User sign-ins (interactive) tab. You can filter by last 7 days, last 24 hours, etc.

how to get Azure Active Directory sign-in logs in Azure Portal

You may also like following the below articles

  • How to get tenant id in Azure using PowerShell
  • Get Storage Accounts Azure PowerShell
  • How To Secure Azure Function With Azure AD
  • How to add bulk guest users in Azure AD B2B from Azure Portal and PowerShell
  • What is Azure Active Directory B2B collaboration (Azure AD B2B)
  • How to create and add members to Azure Active Directory Group
  • How to find deleted users in Azure Active Directory

Final Words

In this article, we discussed how to get sign-in logs in Azure Active Directory using PowerShell and Azure Portal. Thanks for reading this article.

How to find deleted users in Azure Active Directory
How to recover deleted Resource Group Azure

Follow Us

Follow us on Twitter Subscribe us on Youtube

Recent Posts

  • How To use Azure Functions to Send And Read Messages From Azure Service Bus Queues
  • AWS Lambda vs Azure functions
  • How to Create Azure Free Account (Step by Step tutorial)
  • How to create a database in Azure Database for PostgreSQL flexible server
  • Azure PostgreSQL Flexible Server
  • About
  • Contact
  • Privacy Policy
  • Sitemap
© 2023 Azure Lessons