You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
With the Azure Active Directory (Azure AD) **Usage and insights** reports, you can get an application-centric view of your sign-in data. Usage & insights also includes a report on authentication methods activity. You can find answers to the following questions:
18
+
With the Azure Active Directory (Azure AD) **Usage and insights** reports, you can get an application-centric view of your sign-in data. Usage & insights includes a report on authentication methods, service principal sign-ins, and application credential activity. You can find answers to the following questions:
19
19
20
-
* What are the top used applications in my organization?
21
-
* What applications have the most failed sign-ins?
22
-
* What are the top sign-in errors for each application?
20
+
* What are the top used applications in my organization?
21
+
* What applications have the most failed sign-ins?
22
+
* What are the top sign-in errors for each application?
23
+
* What was the date of the last sign-in for an application?
23
24
24
-
This article provides an overview of three reports that look sign-in data.
25
+
## Prerequisites
25
26
26
-
## Access Usage & insights
27
-
28
-
Accessing the data from Usage and insights requires:
27
+
To access the data from Usage and insights you must have:
29
28
30
29
* An Azure AD tenant
31
30
* An Azure AD premium (P1/P2) license to view the sign-in data
32
-
* A user in the Global Administrator, Security Administrator, Security Reader, or Reports Reader roles.
31
+
* A user in the Reports Reader, Security Reader, Security Administrator, or Global Administrator role.
32
+
33
+
## Access Usage and insights
34
+
35
+
You can access the Usage and insights reports from the Azure portal and using Microsoft Graph.
33
36
34
-
To access Usage & insights:
37
+
### To access Usage & insights in the portal:
35
38
36
39
1. Sign in to the [Azure portal](https://portal.azure.com) using the appropriate least privileged role.
37
40
1. Go to **Azure Active Directory** > **Usage & insights**.
38
41
39
-
The **Usage & insights**report is also available from the **Enterprise applications** area of Azure AD. All users can access their own sign-ins at the [My Sign-Ins portal](https://mysignins.microsoft.com/security-info).
42
+
The **Usage & insights**reports are also available from the **Enterprise applications** area of Azure AD. All users can access their own sign-ins at the [My Sign-Ins portal](https://mysignins.microsoft.com/security-info).
40
43
41
-
##View the Usage & insights reports
44
+
### To access Usage & insights using Microsoft Graph:
42
45
43
-
There are currently three reports available in Azure AD Usage & insights. All three reports use sign-in data to provide helpful information an application usage and authentication methods.
46
+
The reports can be viewed and managed using Microsoft Graph on the `/beta` endpoint in Graph Explorer.
44
47
45
-
### Azure AD application activity (preview)
48
+
1. Sign in to [Graph Explorer](https://aka.ms/ge).
49
+
1. Select **GET** as the HTTP method from the dropdown.
50
+
1. Set the API version to **beta**.
51
+
52
+
Refer to the section on each report in this article for the specific objects and parameters to include. For more information, see the [Microsoft Graph documentation for Identity and access reports](/graph/api/resources/report-identity-access).
53
+
54
+
## Azure AD application activity (preview)
46
55
47
56
The **Azure AD application activity (preview)** report shows the list of applications with one or more sign-in attempts. Any application activity during the selected date range appears in the report. The report allows you to sort by the number of successful sign-ins, failed sign-ins, and the success rate.
48
57
49
58
It's possible that activity for a deleted application may appear in the report if the activity took place during the selected date range and before the application was deleted. Other scenarios could include a user attempting to sign in to an application that doesn't have a service principal associated with the app. For these types of scenarios, you may need to review the audit logs or sign-in logs to investigate further.
50
59
51
-
Select the **View sign in activity** link for an application to view more details. The sign-in graph per application counts interactive user sign-ins. The details of any sign-in failures appears below the table.
60
+
To view the details of the sign-in activityfor an application, select the **View sign-in activity** link for the application.
52
61
53
62
54
63
55
-
Select a day in the application usage graph to see a detailed list of the sign-in activities for the application. This detailed list is actually the sign-in log with the filter set to the selected application and date.
64
+
The sign-in activity graph uses interactive user sign-ins. Select a day in the application usage graph to see a detailed list of the sign-in activities for the application. This detailed list is actually the sign-in log with the filter set to the selected application and date. The details of any sign-in failures appear below the table.
56
65
57
66
58
67
59
-
### AD FS application activity
68
+
### Application activity using Microsoft Graph
69
+
70
+
You can view the `applicationSignInSummary` or `applicationSignInDetailedSummary` of Azure AD application activity with Microsoft Graph.
71
+
72
+
Add the following query to view the **sign-in summary**, then select the **Run query** button.
73
+
74
+
```http
75
+
GET https://graph.microsoft.com/beta/reports/getAzureADApplicationSignInSummary(period='{period}')
76
+
```
77
+
78
+
Add the following query to view the **sign-in details**, then select the **Run query** button.
79
+
80
+
```http
81
+
GET https://graph.microsoft.com/beta/reports/applicationSignInDetailedSummary/{id}
82
+
```
83
+
84
+
For more information, see [Application sign-in in Microsoft Graph](/graph/api/resources/applicationsigninsummary?view=graph-rest-beta&preserve-view=true).
85
+
86
+
## AD FS application activity
60
87
61
88
The **AD FS application activity** report in Usage & insights lists all Active Directory Federated Services (AD FS) applications in your organization that have had an active user login to authenticate in the last 30 days. These applications have not been migrated to Azure AD for authentication.
62
89
63
-
### Authentication methods activity
90
+
Viewing the AD FS application activity using Microsoft Graph retrieves a list of the `relyingPartyDetailedSummary` objects, which identifies the relying party to a particular Federation Service.
91
+
92
+
Add the following query, then select the **Run query** button.
93
+
94
+
```http
95
+
GET https://graph.microsoft.com/beta/reports/getRelyingPartyDetailedSummary
96
+
```
97
+
98
+
For more information, see [AD FS application activity in Microsoft Graph](/graph/api/resources/relyingpartydetailedsummary?view=graph-rest-beta&preserve-view=true).
99
+
100
+
## Authentication methods activity
64
101
65
102
The **Authentication methods activity** in Usage & insights displays visualizations of the different authentication methods used by your organization. The **Registration tab** displays statistics of users registered for each of your available authentication methods. Select the **Usage** tab at the top of the page to see actual usage for each authentication method.
66
103
@@ -72,6 +109,108 @@ Looking for the details of a user and their authentication methods? Look at the
72
109
73
110
Looking for the status of an authentication registration or reset event of a user? Look at the **Registration and reset events** report from the side menu and then search for a name or UPN. You'll be able to see the method used to attempt to register or reset an authentication method.
74
111
112
+
## Service principal sign-in activity (preview)
113
+
114
+
The Service principal sign-in activity (preview) report provides the last activity date for every service principal. The report provides you information on the usage of the service principal - whether it was used as a client or resource app and whether it was used in an app-only or delegated context. The report shows the last time the service principal was used.
115
+
116
+
[](./media/concept-usage-insights-report/service-principal-sign-ins.png#lightbox)
117
+
118
+
Select the **View more details** link to locate the client and object IDs for the application as well as specific service principal sign-in activity.
119
+
120
+
[](./media/concept-usage-insights-report/service-principal-sign-in-activity-details.png#lightbox)
121
+
122
+
### Service principal sign-in activity using Microsoft Graph
123
+
124
+
The `servicePrincipalSignInActivity` reports can be viewed using Microsoft Graph in Graph Explorer.
125
+
126
+
Add the following query to retrieve the service principal sign-in activity, then select the **Run query** button.
127
+
128
+
```http
129
+
GET https://graph.microsoft.com/beta/reports/servicePrincipalSignInActivities/{id}
For more information, see [List service principal activity in Microsoft Graph](/graph/api/reportroot-list-serviceprincipalsigninactivities?view=graph-rest-beta&preserve-view=true).
163
+
164
+
## Application credential activity (preview)
165
+
166
+
The Application credential activity (preview) report provides the last credential activity date for every application credential. The report provides the credential type (certificate or client secret), the last used date, and the expiration date. With this report you can view the expiration dates of all your applications in one place.
167
+
168
+
To view the details of the application credential activity, select the **View more details** link. These details include the application object, service principal, and resource IDs. You can also see if the credential origin is the application or the service principal.
169
+
170
+
[](media/concept-usage-insights-report/app-credential-activity.png#lightbox)
171
+
172
+
When you select the **View more details** link, you can see the application object ID and resource ID, in addition to the details visible in the report.
173
+
174
+
[](media/concept-usage-insights-report/app-credential-activity-details.png#lightbox)
175
+
176
+
### Application credential activity using Microsoft Graph
177
+
178
+
Application credential activity can be viewed and managed using Microsoft Graph on the `/beta` endpoint. You can get the application credential sign-in activity by entity `id`, `keyId`, and `appId` .
179
+
180
+
To get started, follow these instructions to work with `appCredentialSignInActivity` using Microsoft Graph in Graph Explorer.
181
+
182
+
1. Sign in to [Graph Explorer](https://aka.ms/ge).
183
+
1. Select **GET** as the HTTP method from the dropdown.
184
+
1. Set the API version to **beta**.
185
+
1. Add the following query to retrieve recommendations, then select the **Run query** button.
186
+
187
+
```http
188
+
GET https://graph.microsoft.com/beta/reports/appCredentialSignInActivities/{id}
For more information, see [Application credential activity in Microsoft Graph](/graph/api/resources/appcredentialsigninactivity?view=graph-rest-beta&preserve-view=true).
213
+
75
214
## Next steps
76
215
77
216
-[Learn about the sign-ins report](concept-sign-ins.md)
0 commit comments