Get-MgAuditLogSignIn timeout 300 seconds

[cmruffin]

Describe the bug

The Get-MgAuditLogSignIn cmdlet basically fails with a timeout. Tenant/User has Entra P1 license, so audit logs are 30 days vs the unlicensed 7 days (result is that there are more overall logs). The end goal is to use the -Filter flag to limit the search results, but this also fails. The workaround stated for the similar issue reported in #2941 was to pull all of the logs and filter them locally, but this is (not / no longer) working. #2941 was thought to believe it is a service issue but my issue does not fail in the portal.

$accessLogs = Get-MgAuditLogSignIn -All
Get-Get-MgAuditLogSignIn_List: The request was canceled due to the configured HttpClient.Timeout of 300 seconds elapsing.

$accessLogs = Get-MgAuditLogSignIn
Get-MgAuditLogSignIn_List: The request was canceled due to the configured HttpClient.Timeout of 300 seconds elapsing.

Expected behavior

cmdlet returns requested logs.

How to reproduce

1. Use Entral P1 License to extend signin log retention to 30 days.
2. Run the cmdlet Get-MgAuditLogSignIn -All,

SDK Version

2.25.0

Latest version known to work for scenario above?

2.25.0

Known Workarounds

none

Debug output

Click to expand log

``` PS C:\Millcore> $accessLogs = Get-MgAuditLogSignIn -All -Debug DEBUG: [CmdletBeginProcessing]: - Get-MgAuditLogSignIn begin processing with parameterSet 'List'. DEBUG: [Authentication]: - AuthType: 'AppOnly', TokenCredentialType: 'ClientCertificate', ContextScope: 'Process', AppName: 'Scripting Service Principal'. DEBUG: [Authentication]: - Scopes: [AuditLog.Read.All]. DEBUG: [CmdletException]: Received exception with message 'TaskCanceledException - The request was canceled due to the configured HttpClient.Timeout of 300 seconds elapsing. : at System.Net.Http.HttpClient.HandleFailure(Exception e, Boolean telemetryStarted, HttpResponseMessage response, CancellationTokenSource cts, CancellationToken cancellationToken, CancellationTokenSource pendingRequestsCts) at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken) at Microsoft.Graph.PowerShell.Reports.AuditLogListSignIn_Call(HttpRequestMessage request, Func`3 on2Xx, Func`3 onDefault, IEventListener eventListener, ISendAsync sender) at Microsoft.Graph.PowerShell.Reports.AuditLogListSignIn_Call(HttpRequestMessage request, Func`3 on2Xx, Func`3 onDefault, IEventListener eventListener, ISendAsync sender) at Microsoft.Graph.PowerShell.Reports.AuditLogListSignIn(Nullable`1 Top, Nullable`1 Skip, String Search, String Filter, Nullable`1 Count, String[] Orderby, String[] Select, String[] Expand, IDictionary headers, Func`3 on2Xx, Func`3 onDefault, IEventListener eventListener, ISendAsync sender) at Microsoft.Graph.PowerShell.Cmdlets.GetMgAuditLogSignIn_List.ProcessRecordAsync()' Get-MgAuditLogSignIn_List: The request was canceled due to the configured HttpClient.Timeout of 300 seconds elapsing. DEBUG: [CmdletEndProcessing]: - Get-MgAuditLogSignIn end processing. ```

Configuration

Windows 2019, AMD64

Other information

Similar errors with Get-EntraAuditSignInLog, Get-AzureADAuditSignInLogs.

[jdarre]

I have the same issue. The script fetches signins from several tenants, and on some of them it gives the error "The request was canceled due to the configured HttpClient.Timeout of 300 seconds elapsing". It looks like it is random. I also did a similar call using the python graph beta sdk, and that also fails in a similar way.
I'm fetching basic auth information, and the filter string i long:
$filters = "createdDateTime ge $($endTime)Z and createdDateTime lt $($currentTime)Z and (clientAppUsed eq 'AutoDiscover' or clientAppUsed eq 'Exchange ActiveSync' or clientAppUsed eq 'Exchange Online PowerShell' or clientAppUsed eq 'Exchange Web Services' or clientAppUsed eq 'IMAP4' or clientAppUsed eq 'MAPI Over HTTP' or clientAppUsed eq 'Offline Address Book' or clientAppUsed eq 'Outlook Anywhere (RPC over HTTP)' or clientAppUsed eq 'Other clients' or clientAppUsed eq 'POP3' or clientAppUsed eq 'Reporting Web Services' or clientAppUsed eq 'Authenticated SMTP' or clientAppUsed eq 'Outlook Service')"

[VerboseCoral]

I've been experiencing this for 3-4 weeks now.

It seems like the it's more likely to fail the more conditions I put in the filter string. I just experienced 4 or 5 failures in a row with:
UserId eq '${UserId}' and createdDateTime ge ${QueryStart}

But, after removing the date, it succeeded 4 times in a row. The filter was just:
UserId eq '${UserId}'

[matany90]

I’m experiencing the same issue. Applying any filter to the query will most likely result in a timeout, while requests without filters work fine.

I believe the issue is with the Graph API itself rather than the SDK because the /auditlogs/signins route throws timeouts when filters are applied.

Any update?

[markd-coasthills]

I am experiencing the same issue. I recently updated to 2.26.1 in hopes that it would help the performance but no. If I run "Get-MgAuditLogSignIn -Top 10", I get 10 records pretty quickly. If I run a simple filter of ""UserPrincipalName eq 'user@domain.com'", it times out frequently.

[robinmalik]

I'm hitting the The request was canceled due to the configured HttpClient.Timeout of 300 seconds elapsing. for every Graph cmdlet whether filtering is used or not. Upgrading to 2.30.0 hasn't helped. Using -verbose and -debug don't help because the cmdlet just hangs immediately. Other machines are ok.