You can create own workbooks by adding text, parameters, links/tabs, queries or metrics to customize your experience. As you see, it's all well structured, displaying the most important information, graph analytics and grouping in this report. I selected the workbook 'Sign-in Analysis Workbook (Preview)'.

There are some example workbooks available: This option is great to get fast and powerful visualized data sets of logs. Workbooks cover the visualization aspect of logs in AAD. Read my full tutorial on Log analytics workspace for more information. If you want to run serious logging in the cloud, there will be no way around this service. This Azure resource requires extra pricing, not included with Azure AD. If you want more insight with custom queries or store data for a longer period of time, you should consider running a Log analytics workspace. Provisioning logs are generated from the provisioning service when creating or modifying resources.

So it's all about operational logs from your tenant. Sign-in logs show any authentication against Azure AD with the corresponding information.ĭisplay events on Azure resources. Base monitoringĪzure Active Directory has an integrated monitoring section, that houses:

This will help you to see how your users interact with Azure AD. And visualization is perhaps one of the most important things when it comes to presenting data.

Also, for investigation purposes, past events are stored and are accessible to understand an event. It helps to see if everything works fine or determine interruptions or problems. Understanding processes in any type of system or orchestration is central to future adaptation and change.

Azure ad audit logs