Union SigninLogs, AADNonInteractiveUserSignInLogs On line two we sort the results by “TimeGenerated” in descending order. Querying the SigninLogs Tableįor example you can query the “SigninLogs” table with the following KQL query which by default will give you the sign-in events of the last 24 hours. Querying both tables individually and comparing the results gives a more complete picture but can become annoying rather quickly if tasked with investigating large amounts of incidents on a daily basis. Knowing that Azure Active Directory differentiates between sign-in types and that Microsoft Sentinel stores the sign-in logs in different tables is important when investigating sign-in related incidents from products like “Azure Active Directory Identity Protection” because any one table does not tell the whole story. For interactive sign-ins this table is called “SigninLogs” and for non-interactive sign-ins this table is called the “AADNonInteractiveUserSignInLogs” table. When you connect Azure Active Directory sign-in logs to Microsoft Sentinel with the “Azure Active Directory Sentinel connector” the interactive sign-in logs and non-interactive sign-in logs are stored in different tables. In this case the user is already authenticated and does not have to provide a username and password interactively.

For example: a browser session that was previously authenticated interactively and is now authenticated because of the cached credential. Another way of saying this is that an interactive sign-in happens if a user logs in by using a keyboard “interactively”.Ī “non-interactive sign-in request” happens when a user authenticates with a saved or cached credential from a previously authenticated session. For example: Azure Active Directory differentiates between an “interactive” sign-in request and a “non-interactive” sign-in request when a user logs in.Īn “interactive sign-in request” happens when user authenticates with a username and password and optionally a multi-factor authentication token. Microsoft Azure Active Directory differentiates between different sign-in types when a user authenticates.

Azure ad sign in