You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/active-directory-b2c-reference-audit-logs.md
+23-13Lines changed: 23 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,14 @@
1
1
---
2
-
title: Audit logs samples and definitions in Azure Active Directory B2C | Microsoft Docs
3
-
description: Guide and samples on accessing the Azure AD B2C Audit logs.
2
+
title: Audit logs samples and definitions in Azure Active Directory B2C
3
+
description: Guide and samples on accessing the Azure AD B2C audit logs.
4
4
services: active-directory-b2c
5
5
author: mmacy
6
6
manager: celestedg
7
7
8
8
ms.service: active-directory
9
9
ms.topic: conceptual
10
10
ms.workload: identity
11
-
ms.date: 08/04/2017
11
+
ms.date: 09/14/2019
12
12
ms.author: marsma
13
13
ms.subservice: B2C
14
14
ms.custom: fasttrack-edit
@@ -25,6 +25,7 @@ Azure Active Directory B2C (Azure AD B2C) emits audit logs containing activity i
25
25
> You cannot see user sign-ins for individual Azure AD B2C applications under the **Users** section of the **Azure Active Directory** or **Azure AD B2C** blades. The sign-ins there will show user activity, but cannot be correlated back to the B2C application that the user signed in to. You must use the audit logs for that, as explained further in this article.
26
26
27
27
## Overview of activities available in the B2C category of audit logs
28
+
28
29
The **B2C** category in audit logs contains the following types of activities:
29
30
30
31
|Activity type |Description |
@@ -40,7 +41,8 @@ The **B2C** category in audit logs contains the following types of activities:
40
41
> For user object CRUD activities, refer to the **Core Directory** category.
41
42
42
43
## Example activity
43
-
The example below shows the data captured when a user signs in with an external identity provider:
44
+
45
+
The example below shows the data captured when a user signs in with an external identity provider:
44
46

45
47
46
48
The activity details panel contains the following relevant information:
@@ -56,6 +58,7 @@ The activity details panel contains the following relevant information:
56
58
| Additional Details | ApplicationId | The **Application ID** of the B2C application that the user is signing in to. |
57
59
58
60
## Accessing audit logs through the Azure portal
61
+
59
62
1. Go to the [Azure portal](https://portal.azure.com). Make sure you are in your B2C directory.
60
63
2. Click on **Azure Active Directory** in the favorites bar on the left
61
64
@@ -71,6 +74,7 @@ The activity details panel contains the following relevant information:
71
74

72
75
73
76
You will see a list of activities logged over the last seven days.
77
+
74
78
- Use the **Activity Resource Type** dropdown to filter by the activity types outlined above
75
79
- Use the **Date Range** dropdown to filter the date range of the activities shown
76
80
- If you click on a specific row in the list, a contextual box on the right will show you additional attributes associated with the activity
@@ -80,28 +84,34 @@ You will see a list of activities logged over the last seven days.
80
84
> You can also see the audit logs by navigating to **Azure AD B2C** rather than **Azure Active Directory** in the favorites bar on the left. Under **Activities**, click on **Audit logs**, where you will find the same logs with similar filtering capabilities.
81
85
82
86
## Accessing audit logs through the Azure AD reporting API
83
-
Audit logs are published to the same pipeline as other activities for Azure Active Directory, so they can be accessed through the [Azure Active Directory reporting API](https://docs.microsoft.com/azure/active-directory/active-directory-reporting-api-audit-reference).
87
+
88
+
Audit logs are published to the same pipeline as other activities for Azure Active Directory, so they can be accessed through the [Azure Active Directory reporting API](https://docs.microsoft.com/graph/api/directoryaudit-list). For more information, see [Get started with the Azure Active Directory reporting API](../active-directory/reports-monitoring/concept-reporting-api.md).
84
89
85
90
### Prerequisites
91
+
86
92
To authenticate to the Azure AD reporting API you first need to register an application. Make sure to follow the steps in [Prerequisites to access the Azure AD reporting APIs](https://azure.microsoft.com/documentation/articles/active-directory-reporting-api-getting-started/).
87
93
88
94
### Accessing the API
95
+
89
96
To download the Azure AD B2C audit logs via the API, you'll want to filter the logs to the **B2C** category. To filter by category, use the query string parameter when calling the Azure AD reporting API endpoint, as shown below:
https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?filter=loggedByService eq 'B2C' and activityDateTime gt 2019-09-10T02:28:17Z
100
+
```
92
101
93
102
### PowerShell script
94
-
The following script provides an example of using PowerShell to query the Azure AD reporting API and store the results as a JSON file:
103
+
104
+
The following script provides an example of using PowerShell to query the Azure AD reporting API and outputting the results to a JSON file:
95
105
96
106
```powershell
97
-
# This script will require registration of a Web Application in Azure Active Directory (see https://azure.microsoft.com/documentation/articles/active-directory-reporting-api-getting-started/)
107
+
# This script requires the registration of a Web Application in Azure Active Directory (see https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-reporting-api)
98
108
99
109
# Constants
100
-
$ClientID = "your-client-application-id-here" # Insert your application's Client ID, a Globally Unique ID (registered by Global Admin)
101
-
$ClientSecret = "your-client-application-secret-here" # Insert your application's Client Key/Secret string
110
+
$ClientID = "your-client-application-id-here" # Insert your application's Client ID, a GUID (registered by Global Admin)
111
+
$ClientSecret = "your-client-application-secret-here" # Insert your application's Client secret/key
112
+
$tenantdomain = "your-b2c-tenant.onmicrosoft.com" # Insert your Azure AD B2C tenant; for example, contoso.onmicrosoft.com
102
113
$loginURL = "https://login.microsoftonline.com"
103
-
$tenantdomain = "your-b2c-tenant.onmicrosoft.com" # AAD B2C Tenant; for example, contoso.onmicrosoft.com
104
-
$resource = "https://graph.windows.net" # Azure AD Graph API resource URI
114
+
$resource = "https://graph.microsoft.com" # Microsoft Graph API resource URI
105
115
$7daysago = "{0:s}" -f (get-date).AddDays(-7) + "Z" # Use 'AddMinutes(-5)' to decrement minutes, for example
106
116
Write-Output "Searching for events starting $7daysago"
0 commit comments