I’m trying to get logs for invalid username attempts using Graph API, by calling this endpoint:
https://graph.microsoft.com/v1.0/auditLogs/signIns
For example, I’m sending a request to “https://login.microsoftonline.com/organizations/oauth2/v2.0/token” to generate a token using grant_type=password, but I’m using a username from a non-existent user, that does not exist in our tenant. Microsoft returns to me:
AADSTS50034: The user account {EmailHidden} does not exist in the domain.com directory. To sign into this application, the account must be added to the directory.rnTrace ID: {GUID}rnCorrelation ID: {GUID}rnTimestamp: {TIMESTAMP}
But this specific error does not show up on:
https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=correlationId eq '{GUID}'.
This metric is important for us to know if the users are using our system correctly.
Can I use another Graph endpoint to extract this information or it’s a limitation from AzureAD?
Thanks and appreciate all kind of advice.
I have one Azure AD application named GraphAug with API permission as below:
When I tried to generate access token by passing username from a non-existent user via Postman, I too got same error:
POST https://login.microsoftonline.com/organizations/oauth2/v2.0/token
client_id:appId
grant_type:password
scope: https://graph.microsoft.com/.default
username:[email protected]
password:xxxxxxxxx
Response:
Now, I ran below query in Graph Explorer by filtering with correlation_id and got blank results same as you:
GET https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=correlationId eq '{GUID}'
Response:
Note that, you can only fetch successful and failed sign-in attempts of existing users in that tenant by running this query: https://graph.microsoft.com/v1.0/auditLogs/signIns
When I tried to generate access token by passing username from a existing user with wrong password via Postman, I got different error saying invalid username or password:
POST https://login.microsoftonline.com/organizations/oauth2/v2.0/token
client_id:appId
grant_type:password
scope: https://graph.microsoft.com/.default
username:[email protected]
password:xxxxxxxxx
Response:
You can extract this log information of existing user by running below query in Graph Explorer, filtering with correlation_id:
GET https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=correlationId eq '{GUID}'
Response:
To confirm that, I checked the same in Portal where the logs are same as below:
Alternatively, you can raise support ticket with Microsoft and share correlation_id with them to get more details of that specific error logs.
1