Now that you have the logs in your workspace, you can now run queries against them. To view the schema for these tables:įrom the default query view in the previous section, select Schema and expand the workspace.Įxpand the Log Management section and then expand either AuditLogs or SigninLogs to view the log schema. The logs are pushed to the AuditLogs and SigninLogs tables in the workspace. View the schema for Azure AD activity logs The workspace will open with a default query. Select Azure Active Directory, and then select Logs from the Monitoring section to open your Log Analytics workspace.

The following roles in Azure Active Directory (if you're accessing Log Analytics through Azure portal).

First, complete the steps to route the Azure AD activity logs to your Log Analytics workspace.

Learn how to create a Log Analytics workspace.

A Log Analytics workspace in your Azure subscription.

In this article, you learn how to analyze the Azure AD activity logs in your Log Analytics workspace. You can also install the Log analytics views for Azure AD activity logs to get access to pre-built reports around audit and sign-in events in your environment.

Analyze Azure AD activity logs with Azure Monitor logsĪfter you integrate Azure AD activity logs with Azure Monitor logs, you can use the power of Azure Monitor logs to gain insights into your environment.

Azure ad sign in logs