You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/reports-monitoring/troubleshoot-audit-data-verified-domain.md
+11-14Lines changed: 11 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,32 +3,29 @@
3
3
title: 'Troubleshoot audit data of verified domain change | Microsoft Docs'
4
4
description: Provides you with information that will appear in the Azure Active Directory activity logs when you change a users verified domain.
5
5
services: active-directory
6
-
documentationcenter: ''
7
-
author: MarkusVi
6
+
author: shlipsey3
8
7
manager: amycolannino
9
-
editor: ''
10
8
ms.service: active-directory
11
9
ms.topic: troubleshooting
12
-
ms.tgt_pltfrm: na
13
10
ms.workload: identity
14
11
ms.subservice: report-monitor
15
-
ms.date: 08/26/2022
16
-
ms.author: markvi
12
+
ms.date: 11/01/2022
13
+
ms.author: sarahlipsey
17
14
ms.collection: M365-identity-device-management
18
15
---
19
16
20
17
# Troubleshoot: Audit data on verified domain change
21
18
22
19
23
-
## I have a lot of changes to my users and I am not sure what the cause of it is.
20
+
## I have a lot of changes to my users and I'm not sure what the cause of it is.
24
21
25
22
### Symptoms
26
23
27
-
I check the Azure AD audit logs, and see multiple user updates occurring in my Azure AD tenant. These **Update User** events do not display **Actor** information, which causes uncertainty as to what/who triggered the mass changes to users.
24
+
I check the Azure AD audit logs, and see multiple user updates occurring in my Azure AD tenant. These **Update User** events don't display **Actor** information, which causes uncertainty as to what/who triggered the mass changes to users.
28
25
29
26
### Cause
30
27
31
-
A common reason behind mass object changes is a non-synchronous backend operation called **ProxyCalc**. **ProxyCalc** is the logic that determines the appropriate **UserPrincipalName** and **Proxy Addresses**, that are updated in Azure AD users, groups or contacts. The design behind **ProxyCalc** is to ensure that all **UserPrincipalName** and **Proxy Addresses** are consistent in Azure AD at any time. **ProxyCalc** must be triggered by an explicit change like a verified domain change and does not perpetually run in the background as a task.
28
+
A common reason behind mass object changes is a non-synchronous backend operation called **ProxyCalc**. **ProxyCalc** is the logic that determines the appropriate **UserPrincipalName** and **Proxy Addresses** that are updated in Azure AD users, groups, or contacts. The design behind **ProxyCalc** is to ensure that all **UserPrincipalName** and **Proxy Addresses** are consistent in Azure AD at any time. **ProxyCalc** must be triggered by an explicit change like a verified domain change and doesn't perpetually run in the background as a task.
32
29
33
30
34
31
@@ -54,17 +51,17 @@ One of the admin tasks that could trigger **ProxyCalc** is whenever there’s a
54
51
55
52
For example, if you add a verified domain Fabrikam.com to your Contoso.onmicrosoft.com tenant, this action will trigger a ProxyCalc operation on all objects in the tenant. This event will be captured in the Azure AD Audit logs as **Update User** events preceded by an **Add verified domain** event. On the other hand, if Fabrikam.com was removed from the Contoso.onmicrosoft.com tenant, then all the **Update User** events will be preceded by a **Remove verified domain** event.
56
53
57
-
#### Additional notes:
54
+
#### Notes:
58
55
59
-
ProxyCalc does not cause changes to certain objects that:
56
+
ProxyCalc doesn't cause changes to certain objects that:
60
57
61
-
-do not have an active Exchange license
58
+
-don't have an active Exchange license
62
59
- have **MSExchRemoteRecipientType** set to Null
63
-
-are not considered a shared resource. Shared Resource is when **CloudMSExchRecipientDisplayType** contains one of the following values: **MailboxUser (shared)**, **PublicFolder**, **ConferenceRoomMailbox**, **EquipmentMailbox**, **ArbitrationMailbox**, **RoomList**, **TeamMailboxUser**, **Group mailbox**, **Scheduling mailbox**, **ACLableMailboxUser**, **ACLableTeamMailboxUser**
60
+
-aren't considered a shared resource. Shared Resource is when **CloudMSExchRecipientDisplayType** contains one of the following values: **MailboxUser (shared)**, **PublicFolder**, **ConferenceRoomMailbox**, **EquipmentMailbox**, **ArbitrationMailbox**, **RoomList**, **TeamMailboxUser**, **Group mailbox**, **Scheduling mailbox**, **ACLableMailboxUser**, **ACLableTeamMailboxUser**
64
61
65
62
In order to build more correlation between these two disparate events, Microsoft is working on updating the **Actor** info in the audit logs to identify these changes as triggered by a verified domain change. This action will help check when the verified domain change event took place and started to mass update the objects in their tenant.
66
63
67
-
Additionally, in most cases, there are no changes to users as their **UserPrincipalName** and **Proxy Addresses** are consistent, so we are working to display in Audit Logs only those updates that caused an actual change to the object. This action will prevent noise in the audit logs and help admins correlate the remaining user changes to verified domain change event as explained above.
64
+
Additionally, in most cases, there are no changes to users as their **UserPrincipalName** and **Proxy Addresses** are consistent, so we're working to display in Audit Logs only those updates that caused an actual change to the object. This action will prevent noise in the audit logs and help admins correlate the remaining user changes to verified domain change event as explained above.
Copy file name to clipboardExpand all lines: articles/active-directory/reports-monitoring/troubleshoot-graph-api.md
+4-9Lines changed: 4 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,19 +3,14 @@
3
3
title: 'Troubleshoot errors in Azure Active Directory reporting API | Microsoft Docs'
4
4
description: Provides you with a resolution to errors while calling Azure Active Directory Reporting APIs.
5
5
services: active-directory
6
-
documentationcenter: ''
7
-
author: MarkusVi
6
+
author: shlipsey3
8
7
manager: amycolannino
9
-
editor: ''
10
-
11
-
ms.assetid: 0030c5a4-16f0-46f4-ad30-782e7fea7e40
12
8
ms.service: active-directory
13
9
ms.topic: troubleshooting
14
-
ms.tgt_pltfrm: na
15
10
ms.workload: identity
16
11
ms.subservice: report-monitor
17
-
ms.date: 08/26/2022
18
-
ms.author: markvi
12
+
ms.date: 11/01/2022
13
+
ms.author: sarahlipsey
19
14
ms.reviewer: dhanyahk
20
15
21
16
ms.collection: M365-identity-device-management
@@ -37,7 +32,7 @@ Accessing sign-in reports requires an Azure Active Directory premium 1 (P1) lice
37
32
38
33
If you see this error message while trying to access audit logs or sign-ins using the API, make sure that your account is part of the **Security Reader** or **Report Reader** role in your Azure Active Directory tenant.
### Error: Application missing Azure AD 'Read directory data' permission
41
36
42
37
Follow the steps in the [Prerequisites to access the Azure Active Directory reporting API](howto-configure-prerequisites-for-reporting-api.md) to ensure your application is running with the right set of permissions.
I performed some actions in the Azure portal and expected to see the audit logs for those actions in the `Activity logs > Audit Logs` blade, but I can’t find them.
25
+
I performed some actions in the Azure portal and expected to see the audit logs for those actions in the `Activity logs > Audit Logs`, but I can’t find them.
@@ -42,13 +37,13 @@ Actions don’t appear immediately in the activity logs. The table below enumera
42
37
43
38
### Resolution
44
39
45
-
Wait for 15 minutes to two hours and see if the actions appear in the log. If you don’t see the logs even after two hours, please [file a support ticket](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest) and we will look into it.
40
+
Wait for 15 minutes to two hours and see if the actions appear in the log. If you don’t see the logs even after two hours, [file a support request,](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest) and we'll look into it.
46
41
47
42
## I can’t find recent user sign-ins in the Azure Active Directory sign-ins activity log
48
43
49
44
### Symptoms
50
45
51
-
I recently signed into the Azure portal and expected to see the sign-in logs for those actions in the `Activity logs > Sign-ins` blade, but I can’t find them.
46
+
I recently signed into the Azure portal and expected to see the sign-in logs for those actions in the `Activity logs > Sign-ins`, but I can’t find them.
52
47
53
48
54
49
@@ -63,7 +58,7 @@ Actions don’t appear immediately in the activity logs. The table below enumera
63
58
64
59
### Resolution
65
60
66
-
Wait for 15 minutes to two hours and see if the actions appear in the log. If you don’t see the logs even after two hours, please [file a support ticket](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest) and we will look into it.
61
+
Wait for 15 minutes to two hours and see if the actions appear in the log. If you don’t see the logs even after two hours, [file a support request,](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest) and we'll look into it.
67
62
68
63
## I can't view more than 30 days of report data in the Azure portal
69
64
@@ -80,7 +75,7 @@ Depending on your license, Azure Active Directory Actions stores activity report
80
75
| Report | Azure AD Free | Azure AD Premium P1 | Azure AD Premium P2 |
81
76
| --- | --- | --- | --- |
82
77
| Directory Audit | 7 days | 30 days | 30 days |
83
-
| Sign-in Activity | Not available. You can access your own sign-ins for 7 days from the individual user profile blade | 30 days | 30 days |
78
+
| Sign-in Activity | Not available. You can access your own sign-ins for 7 days from the individual user profile | 30 days | 30 days |
84
79
85
80
For more information, see [Azure Active Directory report retention policies](reference-reports-data-retention.md).
Copy file name to clipboardExpand all lines: articles/active-directory/reports-monitoring/workbook-authentication-prompts-analysis.md
+8-11Lines changed: 8 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,17 +3,14 @@
3
3
title: Authentication prompts analysis workbook in Azure AD | Microsoft Docs
4
4
description: Learn how to use the authentication prompts analysis workbook.
5
5
services: active-directory
6
-
documentationcenter: ''
7
-
author: MarkusVi
6
+
author: shlipsey3
8
7
manager: amycolannino
9
-
editor: ''
10
-
11
8
ms.service: active-directory
12
9
ms.topic: reference
13
10
ms.workload: identity
14
11
ms.subservice: report-monitor
15
-
ms.date: 08/26/2022
16
-
ms.author: markvi
12
+
ms.date: 11/01/2022
13
+
ms.author: sarahlipsey
17
14
ms.reviewer: sarbar
18
15
19
16
ms.collection: M365-identity-device-management
@@ -33,7 +30,7 @@ This article provides you with an overview of this workbook.
33
30
34
31
Have you recently heard of complaints from your users about getting too many authentication prompts?
35
32
36
-
Over prompting users impacts your user's productivity and often leads users getting phished for MFA. To be clear, MFA is essential! We are not talking about if you should require MFA but how frequently you should prompt your users.
33
+
Overprompting users can affect your user's productivity and often leads users getting phished for MFA. To be clear, MFA is essential! We are not talking about if you should require MFA but how frequently you should prompt your users.
37
34
38
35
Typically, this scenario is caused by:
39
36
@@ -77,7 +74,7 @@ In many environments, the most used apps are business productivity apps. Anythin
77
74
78
75
79
76
80
-
The prompts by application list-view shows additional information such as timestamps, and request IDs that help with investigations.
77
+
The prompts by application listview shows additional information such as timestamps, and request IDs that help with investigations.
81
78
82
79
Additionally, you get a summary of the average and median prompts count for your tenant.
83
80
@@ -106,7 +103,7 @@ Filtering for a specific user that has many authentication requests or only show
106
103
## Best practices
107
104
108
105
109
-
If data isn't showing up or seems to be showing up incorrectly, please confirm that you have set the **Log Analytics Workspace** and **Subscriptions** on the proper resources.
106
+
If data isn't showing up or seems to be showing up incorrectly, confirm that you have set the **Log Analytics Workspace** and **Subscriptions** on the proper resources.
110
107
111
108
112
109
@@ -120,9 +117,9 @@ If the visuals are taking too much time to load, try reducing the Time filter to
120
117
121
118
## Next steps
122
119
123
-
- To understand more about the different policies that impact MFA prompts, see [Optimize reauthentication prompts and understand session lifetime for Azure AD Multi-Factor Authentication](../authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md).
120
+
- To understand more about the different policies that affect MFA prompts, see [Optimize reauthentication prompts and understand session lifetime for Azure AD Multi-Factor Authentication](../authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md).
124
121
125
-
- To learn more about the different vulnerabilities of different MFA methods, see [All your creds are belong to us!](https://aka.ms/allyourcreds).
122
+
- To learn more about the different vulnerabilities of different MFA methods, see [All your creds belong to us!](https://aka.ms/allyourcreds).
126
123
127
124
- To learn how to move users from telecom-based methods to the Authenticator app, see [How to run a registration campaign to set up Microsoft Authenticator - Microsoft Authenticator app](../authentication/how-to-mfa-registration-campaign.md).
0 commit comments