Skip to content

Commit eae0ff3

Browse files
HeidiSteenHeidiSteen
committed
Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into heidist-bugfix
2 parents f299f55 + 54f87cf commit eae0ff3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+627
-288
lines changed

‎.openpublishing.redirection.json

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52173,6 +52173,11 @@
5217352173
"source_path": "articles/sql-database-edge/tutorial-sync-data-factory.md",
5217452174
"redirect_url": "/azure/azure-sql-edge/tutorial-sync-data-factory",
5217552175
"redirect_document_id": true
52176-
}
52176+
},
52177+
{
52178+
"source_path":"articles/azure-monitor/app/alerts.md",
52179+
"redirect_url":"/articles/azure-monitor/platform/alerts-log",
52180+
"redirect_document_id": false
52181+
}
5217752182
]
5217852183
}

‎articles/active-directory/authentication/howto-mfa-reporting.md

Lines changed: 77 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
2-
title: Access and usage reports for Azure MFA - Azure Active Directory
3-
description: This describes how to use the Azure Multi-Factor Authentication feature - reports.
2+
title: Sign-in event details for Azure Multi-Factor Authentication - Azure Active Directory
3+
description: Learn how to view sign-in activity for Azure Multi-Factor Authentication events and status messages.
44

55
services: multi-factor-authentication
66
ms.service: active-directory
77
ms.subservice: authentication
88
ms.topic: how-to
9-
ms.date: 07/30/2018
9+
ms.date: 05/15/2020
1010

1111
ms.author: iainfou
1212
author: iainfoulds
@@ -15,31 +15,15 @@ ms.reviewer: michmcla
1515

1616
ms.collection: M365-identity-device-management
1717
---
18-
# Reports in Azure Multi-Factor Authentication
18+
# Use the sign-ins report to review Azure Multi-Factor Authentication events
1919

20-
Azure Multi-Factor Authentication provides several reports that can be used by you and your organization accessible through the Azure portal. The following table lists the available reports:
20+
To review and understand Azure Multi-Factor Authentication events, you can use the Azure Active Directory (Azure AD) sign-ins report. This report shows authentication details for events when a user is prompted for multi-factor authentication, and if any Conditional Access policies were in use. For detailed information on the sign-ins report, see the [overview of sign-in activity reports in Azure AD](../reports-monitoring/concept-sign-ins.md).
2121

22-
| Report | Location | Description |
23-
|:--- |:--- |:--- |
24-
| Blocked User History | Azure AD > Security > MFA > Block/unblock users | Shows the history of requests to block or unblock users. |
25-
| Usage and fraud alerts | Azure AD > Sign-ins | Provides information on overall usage, user summary, and user details; as well as a history of fraud alerts submitted during the date range specified. |
26-
| Usage for on-premises components | Azure AD > Security > MFA > Activity Report | Provides information on overall usage for MFA through the NPS extension, ADFS, and MFA server. |
27-
| Bypassed User History | Azure AD > Security > MFA > One-time bypass | Provides a history of requests to bypass Multi-Factor Authentication for a user. |
28-
| Server status | Azure AD > Security > MFA > Server status | Displays the status of Multi-Factor Authentication Servers associated with your account. |
29-
30-
## View MFA reports
31-
32-
1. Sign in to the [Azure portal](https://portal.azure.com).
33-
2. On the left, select **Azure Active Directory** > **Security** > **MFA**.
34-
3. Select the report that you wish to view.
35-
36-
![MFA Server server status report in the Azure portal](./media/howto-mfa-reporting/report.png)
37-
38-
## Azure AD sign-ins report
22+
This article shows you how to view the Azure AD sign-ins report in the Azure portal, and then the MSOnline V1 PowerShell module.
3923

40-
With the **sign-ins activity report** in the [Azure portal](https://portal.azure.com), you can get the information you need to determine how your environment is doing.
24+
## View the Azure AD sign-ins report
4125

42-
The sign-ins report can provide you with information about the usage of managed applications and user sign-in activities, which includes information about multi-factor authentication (MFA) usage. The MFA data gives you insights into how MFA is working in your organization. It enables you to answer questions like:
26+
The sign-ins report provides you with information about the usage of managed applications and user sign-in activities, which includes information about multi-factor authentication (MFA) usage. The MFA data gives you insights into how MFA is working in your organization. It lets you answer questions like the following:
4327

4428
- Was the sign-in challenged with MFA?
4529
- How did the user complete MFA?
@@ -48,94 +32,76 @@ The sign-ins report can provide you with information about the usage of managed
4832
- How many users are unable to complete the MFA challenge?
4933
- What are the common MFA issues end users are running into?
5034

51-
This data is available through the [Azure portal](https://portal.azure.com) and the [reporting API](../reports-monitoring/concept-reporting-api.md).
52-
53-
![Azure AD sign-ins report in the Azure portal](./media/howto-mfa-reporting/sign-in-report.png)
54-
55-
### Sign-ins report structure
56-
57-
The sign-in activity reports for MFA give you access to the following information:
58-
59-
**MFA required:** Whether MFA is required for the sign-in or not. MFA can be required due to per-user MFA, Conditional Access, or other reasons. Possible values are **Yes** or **No**.
60-
61-
**MFA Result:** More information on whether MFA was satisfied or denied:
62-
63-
- If MFA was satisfied, this column provides more information about how MFA was satisfied.
64-
- Azure Multi-Factor Authentication
65-
- completed in the cloud
66-
- has expired due to the policies configured on tenant
67-
- registration prompted
68-
- satisfied by claim in the token
69-
- satisfied by claim provided by external provider
70-
- satisfied by strong authentication
71-
- skipped as flow exercised was Windows broker logon flow
72-
- skipped due to app password
73-
- skipped due to location
74-
- skipped due to registered device
75-
- skipped due to remembered device
76-
- successfully completed
77-
- Redirected to external provider for multi-factor authentication
78-
79-
- If MFA was denied, this column would provide the reason for denial.
80-
- Azure Multi-Factor Authentication denied;
81-
- authentication in-progress
82-
- duplicate authentication attempt
83-
- entered incorrect code too many times
84-
- invalid authentication
85-
- invalid mobile app verification code
86-
- misconfiguration
87-
- phone call went to voicemail
88-
- phone number has an invalid format
89-
- service error
90-
- unable to reach the user's phone
91-
- unable to send the mobile app notification to the device
92-
- unable to send the mobile app notification
93-
- user declined the authentication
94-
- user did not respond to mobile app notification
95-
- user does not have any verification methods registered
96-
- user entered incorrect code
97-
- user entered incorrect PIN
98-
- user hung up the phone call without succeeding the authentication
99-
- user is blocked
100-
- user never entered the verification code
101-
- user not found
102-
- verification code already used once
103-
104-
**MFA authentication method:** The authentication method the user used to complete MFA. Possible values include:
105-
106-
- Text message
107-
- Mobile app notification
108-
- Phone call (Authentication phone)
109-
- Mobile app verification code
110-
- Phone call (Office phone)
111-
- Phone call (Alternate authentication phone)
112-
113-
**MFA authentication detail:** Scrubbed version of the phone number, for example: +X XXXXXXXX64.
114-
115-
**Conditional Access** Find information about Conditional Access policies that affected the sign-in attempt including:
116-
117-
- Policy name
118-
- Grant controls
119-
- Session controls
120-
- Result
35+
To view the sign-in activity report in the [Azure portal](https://portal.azure.com), complete the following steps. You can also query data using the [reporting API](../reports-monitoring/concept-reporting-api.md).
36+
37+
1. Sign in to the [Azure portal](https://portal.azure.com) using an account with *global administrator* permissions.
38+
1. Search for and select **Azure Active Directory**, then choose **Users** from the menu on the left-hand side.
39+
1. Under *Activity* from the menu on the left-hand side, select **Sign-ins**.
40+
1. A list of sign-in events is shown, including the status. You can select an event to view more details.
41+
42+
The *Authentication Details* or *Conditional Access* tab of the event details shows you the status code or which policy triggered the MFA prompt.
43+
44+
[![](media/howto-mfa-reporting/sign-in-report-cropped.png "Screenshot of example Azure Active Directory sign-ins report in the Azure portal")](media/howto-mfa-reporting/sign-in-report.png#lightbox)
45+
46+
If available, the authentication is shown, such as text message, Microsoft Authenticator app notification, or phone call.
47+
48+
The following details are shown on the *Authentication Details* window for a sign-in event that show if the MFA request was satisfied or denied:
49+
50+
* If MFA was satisfied, this column provides more information about how MFA was satisfied.
51+
* completed in the cloud
52+
* has expired due to the policies configured on tenant
53+
* registration prompted
54+
* satisfied by claim in the token
55+
* satisfied by claim provided by external provider
56+
* satisfied by strong authentication
57+
* skipped as flow exercised was Windows broker logon flow
58+
* skipped due to app password
59+
* skipped due to location
60+
* skipped due to registered device
61+
* skipped due to remembered device
62+
* successfully completed
63+
64+
* If MFA was denied, this column would provide the reason for denial.
65+
* authentication in-progress
66+
* duplicate authentication attempt
67+
* entered incorrect code too many times
68+
* invalid authentication
69+
* invalid mobile app verification code
70+
* misconfiguration
71+
* phone call went to voicemail
72+
* phone number has an invalid format
73+
* service error
74+
* unable to reach the user's phone
75+
* unable to send the mobile app notification to the device
76+
* unable to send the mobile app notification
77+
* user declined the authentication
78+
* user did not respond to mobile app notification
79+
* user does not have any verification methods registered
80+
* user entered incorrect code
81+
* user entered incorrect PIN
82+
* user hung up the phone call without succeeding the authentication
83+
* user is blocked
84+
* user never entered the verification code
85+
* user not found
86+
* verification code already used once
12187

12288
## PowerShell reporting on users registered for MFA
12389

12490
First, ensure that you have the [MSOnline V1 PowerShell module](https://docs.microsoft.com/powershell/azure/active-directory/overview?view=azureadps-1.0) installed.
12591

126-
Identify users who have registered for MFA using the PowerShell that follows. This set of commands excludes disabled users since these accounts cannot authenticate against Azure AD.
92+
Identify users who have registered for MFA using the PowerShell that follows. This set of commands excludes disabled users since these accounts cannot authenticate against Azure AD:
12793

12894
```powershell
12995
Get-MsolUser -All | Where-Object {$_.StrongAuthenticationMethods -ne $null -and $_.BlockCredential -eq $False} | Select-Object -Property UserPrincipalName
13096
```
13197

132-
Identify users who have not registered for MFA using the PowerShell that follows. This set of commands excludes disabled users since these accounts cannot authenticate against Azure AD.
98+
Identify users who have not registered for MFA using the PowerShell that follows. This set of commands excludes disabled users since these accounts cannot authenticate against Azure AD:
13399

134100
```powershell
135101
Get-MsolUser -All | Where-Object {$_.StrongAuthenticationMethods.Count -eq 0 -and $_.BlockCredential -eq $False} | Select-Object -Property UserPrincipalName
136102
```
137103

138-
Identify users and output methods registered.
104+
Identify users and output methods registered:
139105

140106
```powershell
141107
Get-MsolUser -All | Select-Object @{N='UserPrincipalName';E={$_.UserPrincipalName}},
@@ -145,9 +111,9 @@ Get-MsolUser -All | Select-Object @{N='UserPrincipalName';E={$_.UserPrincipalNam
145111
@{N='MFA Methods';E={$_.StrongAuthenticationMethods.methodtype}} | Export-Csv -Path c:\MFA_Report.csv -NoTypeInformation
146112
```
147113

148-
## Possible results in activity reports
114+
## Downloaded activity reports result codes
149115

150-
The following table may be used to troubleshoot multi-factor authentication using the downloaded version of the multi-factor authentication activity report. They will not appear directly in the Azure portal.
116+
The following table can help troubleshoot events using the downloaded version of the activity report from the previous portal steps or PowerShell commands. These result codes don't appear directly in the Azure portal.
151117

152118
| Call Result | Description | Broad description |
153119
| --- | --- | --- |
@@ -197,8 +163,17 @@ The following table may be used to troubleshoot multi-factor authentication usin
197163
| FAILED_AUTH_RESULT_TIMEOUT | Auth Result Timeout | The user took too long to complete the Multi-Factor Authentication attempt. |
198164
| FAILED_AUTHENTICATION_THROTTLED | Authentication Throttled | The Multi-Factor Authentication attempt was throttled by the service. |
199165

166+
## Additional MFA reports
167+
168+
The following additional information and reports are available for MFA events, including those for MFA Server:
169+
170+
| Report | Location | Description |
171+
|:--- |:--- |:--- |
172+
| Blocked User History | Azure AD > Security > MFA > Block/unblock users | Shows the history of requests to block or unblock users. |
173+
| Usage for on-premises components | Azure AD > Security > MFA > Activity Report | Provides information on overall usage for MFA Server through the NPS extension, ADFS, and MFA Server. |
174+
| Bypassed User History | Azure AD > Security > MFA > One-time bypass | Provides a history of MFA Server requests to bypass MFA for a user. |
175+
| Server status | Azure AD > Security > MFA > Server status | Displays the status of MFA Servers associated with your account. |
176+
200177
## Next steps
201178

202-
* [SSPR and MFA usage and insights reporting](howto-authentication-methods-usage-insights.md)
203-
* [For Users](../user-help/multi-factor-authentication-end-user.md)
204-
* [Where to deploy](concept-mfa-whichversion.md)
179+
This article provided an overview of the sign-ins activity report. For more detailed information on what this report contains and understand the data, see [sign-in activity reports in Azure AD](../reports-monitoring/concept-sign-ins.md).

‎articles/active-directory/authentication/howto-mfa-userstates.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,4 +184,4 @@ Get-MsolUser -All | Set-MfaState -State Disabled
184184

185185
To configure Azure Multi-Factor Authentication settings like trusted IPs, custom voice messages, and fraud alerts, see [Configure Azure Multi-Factor Authentication settings](howto-mfa-mfasettings.md). To manage user settings for Azure Multi-Factor Authentication, see [Manage user settings with Azure Multi-Factor Authentication](howto-mfa-userdevicesettings.md).
186186

187-
To understand why a user was prompted or not prompted to perform MFA, see [Azure Multi-Factor Authentication reports](howto-mfa-reporting.md#azure-ad-sign-ins-report).
187+
To understand why a user was prompted or not prompted to perform MFA, see [Azure Multi-Factor Authentication reports](howto-mfa-reporting.md).

‎articles/active-directory/authentication/media/howto-mfa-reporting/sign-in-report-cropped.png

53.4 KB
Loading

‎articles/active-directory/authentication/media/howto-mfa-reporting/sign-in-report.png

-32.1 KB
Loading

0 commit comments

Comments
 (0)