You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Azure Active Directory B2C (Azure AD B2C) emits audit logs containing activity information about B2C resources, issued tokens, and administrator access. This article provides a brief overview of the information available through audit logs and instructions on how to access this data for your Azure AD B2C tenant.
19
+
Azure Active Directory B2C (Azure AD B2C) emits audit logs containing activity information about B2C resources, tokens issued, and administrator access. This article provides a brief overview of the information available in audit logs and instructions on how to access this data for your Azure AD B2C tenant.
20
20
21
-
> [!IMPORTANT]
22
-
> Audit logs are only retained for seven days. Plan to download and store your logs using one of the methods shown below if you require a longer retention period.
21
+
Audit log events are only retained for **seven days**. Plan to download and store your logs using one of the methods shown below if you require a longer retention period.
23
22
24
23
> [!NOTE]
25
-
> You cannot see user sign-ins for individual Azure AD B2C applications under the **Users** section of the **Azure Active Directory** or **Azure AD B2C**blades. The sign-ins there will show user activity, but cannot be correlated back to the B2C application that the user signed in to. You must use the audit logs for that, as explained further in this article.
24
+
> You can't see user sign-ins for individual Azure AD B2C applications under the **Users** section of the **Azure Active Directory** or **Azure AD B2C**pages in the Azure portal. The sign-in events there show user activity, but can't be correlated back to the B2C application that the user signed in to. You must use the audit logs for that, as explained further in this article.
26
25
27
26
## Overview of activities available in the B2C category of audit logs
28
27
29
28
The **B2C** category in audit logs contains the following types of activities:
30
29
31
30
|Activity type |Description |
32
31
|---------|---------|
33
-
|Authorization |Activities concerning the authorization of a user to access B2C resources (for example, an administrator accessing a list of B2C policies) |
34
-
|Directory |Activities related to directory attributes retrieved when an administrator signs in using the Azure portal |
35
-
|Application | CRUD operations on B2C applications |
36
-
|Key |CRUD operations on keys stored in B2C key container |
37
-
|Resource |CRUD operations on B2C resources (for example, policies and identity providers)
38
-
|Authentication |Validation of user credentials and token issuance|
32
+
|Authorization |Activities concerning the authorization of a user to access B2C resources (for example, an administrator accessing a list of B2C policies).|
33
+
|Directory |Activities related to directory attributes retrieved when an administrator signs in using the Azure portal.|
34
+
|Application |Create, read, update, and delete (CRUD) operations on B2C applications.|
35
+
|Key |CRUD operations on keys stored in a B2C key container.|
36
+
|Resource |CRUD operations on B2C resources. For example, policies and identity providers.
37
+
|Authentication |Validation of user credentials and token issuance.|
39
38
40
-
> [!NOTE]
41
-
> For user object CRUD activities, refer to the **Core Directory** category.
39
+
For user object CRUD activities, refer to the **Core Directory** category.
42
40
43
41
## Example activity
44
42
45
-
The example below shows the data captured when a user signs in with an external identity provider:
46
-
43
+
This example image from the Azure portal shows the data captured when a user signs in with an external identity provider, in this case, Facebook:
44
+
45
+
47
46
48
47
The activity details panel contains the following relevant information:
49
48
50
49
|Section|Field|Description|
51
50
|-------|-----|-----------|
52
-
| Activity | Name | Which activity took place. For example, "Issue an id_token to the application" (which concludes the actual user sign-in). |
53
-
| Initiated By (Actor) | ObjectId | The **Object ID** of the B2C application that the user is signing in to (this identifier is not visible in the Azure portal but it's accessible via the Graph API for example). |
51
+
| Activity | Name | Which activity took place. For example, *Issue an id_token to the application*, which concludes the actual user sign-in. |
52
+
| Initiated By (Actor) | ObjectId | The **Object ID** of the B2C application that the user is signing in to. This identifier is not visible in the Azure portal, but is accessible via the Microsoft Graph API. |
54
53
| Initiated By (Actor) | Spn | The **Application ID** of the B2C application that the user is signing in to. |
55
54
| Target(s) | ObjectId | The **Object ID** of the user that is signing in. |
56
55
| Additional Details | TenantId | The **Tenant ID** of the Azure AD B2C tenant. |
57
56
| Additional Details | PolicyId | The **Policy ID** of the user flow (policy) being used to sign the user in. |
58
57
| Additional Details | ApplicationId | The **Application ID** of the B2C application that the user is signing in to. |
59
58
60
-
## Accessing audit logs through the Azure portal
59
+
## View audit logs in the Azure portal
61
60
62
-
1. Go to the [Azure portal](https://portal.azure.com). Make sure you are in your B2C directory.
63
-
2. Click on **Azure Active Directory** in the favorites bar on the left
61
+
The Azure portal provides access to the audit log events in your Azure AD B2C tenant.
64
62
65
-
63
+
1. Sign in to the [Azure portal](https://portal.azure.com)
64
+
1. Switch to the directory that contains your Azure AD B2C tenant, and then browse to **Azure AD B2C**.
65
+
1. Under **Activities** in the left menu, select **Audit logs**.
66
66
67
-
1. Under **Activity**, click on **Audit Logs**
67
+
A list of activity events logged over the last seven days is displayed.
68
68
69
-
69
+
70
70
71
-
2. In the **Category** dropbox, select **B2C**
72
-
3. Click on **Apply**
71
+
Several filtering options are available, including:
73
72
74
-
73
+
***Activity Resource Type** - Filter by the activity types shown in the table in the [Overview of activities available](#overview-of-activities-available-in-the-b2c-category-of-audit-logs) section.
74
+
***Date** - Filter the date range of the activities shown.
75
75
76
-
You will see a list of activities logged over the last seven days.
76
+
If you select a row in the list, the activity details for the event are displayed.
77
77
78
-
- Use the **Activity Resource Type** dropdown to filter by the activity types outlined above
79
-
- Use the **Date Range** dropdown to filter the date range of the activities shown
80
-
- If you click on a specific row in the list, a contextual box on the right will show you additional attributes associated with the activity
81
-
- Click on **Download** to download the activities as a csv file
78
+
To download the list of activity events in a comma-separated values (CSV) file, select **Download**.
82
79
83
-
> [!NOTE]
84
-
> You can also see the audit logs by navigating to **Azure AD B2C** rather than **Azure Active Directory** in the favorites bar on the left. Under **Activities**, click on **Audit logs**, where you will find the same logs with similar filtering capabilities.
85
-
86
-
## Accessing audit logs through the Azure AD reporting API
80
+
## Get audit logs with the Azure AD reporting API
87
81
88
82
Audit logs are published to the same pipeline as other activities for Azure Active Directory, so they can be accessed through the [Azure Active Directory reporting API](https://docs.microsoft.com/graph/api/directoryaudit-list). For more information, see [Get started with the Azure Active Directory reporting API](../active-directory/reports-monitoring/concept-reporting-api.md).
89
83
90
-
### Prerequisites
84
+
### Enable reporting API access
85
+
86
+
To allow script- or application-based access to the Azure AD reporting API, you need an Azure Active Directory application registered in your Azure AD B2C tenant with the following API permissions:
87
+
88
+
* Microsoft Graph
89
+
* Application: Read all audit log data
90
+
91
+
You can enable these permissions on an existing application registration within your B2C tenant, or create a new one specifically for use with audit log automation.
92
+
93
+
To create a new application, assign the required API permissions, and create a client secret, perform the following steps:
94
+
95
+
1. Register application
96
+
1. Sign in to the [Azure portal](https://portal.azure.com), switch to the directory that contains your Azure AD B2C tenant, and then browse to **Azure AD B2C**.
97
+
1. Under **Manage** in the left menu, select **App registrations (Legacy)**.
98
+
1. Select **New application registration**
99
+
1. Enter a name for the application. For example, *Audit Log App*.
100
+
1. Enter any valid URL in **Sign-on URL**. For example, *https://localhost*. This endpoint does not need to be reachable, but needs to be a valid URL.
101
+
1. Select **Create**.
102
+
1. Record the **Application ID** that appears on the **Registered app** page. You need this value for authentication in automation scripts like the example PowerShell script shown in a later section.
103
+
1. Assign API access permissions
104
+
1. On the **Registered app** overview page, select **Settings**.
105
+
1. Under **API ACCESS**, select **Required permissions**.
106
+
1. Select **Add**, and then **Select an API**.
107
+
1. Select **Microsoft Graph**, and then **Select**.
108
+
1. Under **APPLICATION PERMISSIONS**, select **Read all audit log data**.
109
+
1. Select the **Select** button, and then select **Done**.
110
+
1. Select **Grant permissions**, and then select **Yes**.
111
+
1. Create client secret
112
+
1. Under **API ACCESS**, select **Keys**.
113
+
1. Enter a description for the key in the **Key description** box. For example, *Audit Log Key*.
114
+
1. Select a validity **Duration**, then select **Save**.
115
+
1. Record the key's **VALUE**. You need this value for authentication in automation scripts like the example PowerShell script shown in a later section.
91
116
92
-
To authenticate to the Azure AD reporting API you first need to register an application. Make sure to follow the steps in [Prerequisites to access the Azure AD reporting APIs](https://azure.microsoft.com/documentation/articles/active-directory-reporting-api-getting-started/).
117
+
You now have an application with the required API access, an application ID, and a key that you can use in your automation scripts. See the PowerShell script section later in this article for an example of how you can get activity events with a script.
93
118
94
-
### Accessing the API
119
+
### Access the API
95
120
96
-
To download the Azure AD B2C audit logs via the API, you'll want to filter the logs to the **B2C** category. To filter by category, use the query string parameter when calling the Azure AD reporting API endpoint, as shown below:
121
+
To download Azure AD B2C audit log events via the API, filter the logs on the `B2C` category. To filter by category, use the `filter`query string parameter when you call the Azure AD reporting API endpoint.
97
122
98
123
```HTTP
99
-
https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?filter=loggedByService eq 'B2C' and activityDateTime gt 2019-09-10T02:28:17Z
124
+
https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$filter=loggedByService eq 'B2C' and activityDateTime gt 2019-09-10T02:28:17Z
100
125
```
101
126
102
127
### PowerShell script
103
128
104
-
The following script provides an example of using PowerShell to query the Azure AD reporting API and outputting the results to a JSON file:
129
+
The following PowerShell script shows an example of how to query the Azure AD reporting API. After querying the API, it prints the logged events to standard output, then writes the JSON output to a file.
130
+
131
+
You can try this script in the [Azure Cloud Shell](../cloud-shell/overview.md). Be sure to update it with your application ID, key, and the name of your Azure AD B2C tenant.
105
132
106
133
```powershell
107
-
# This script requires the registration of a Web Application in Azure Active Directory (see https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-reporting-api)
134
+
# This script requires the registration of a Web Application in Azure Active Directory:
0 commit comments