Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,420 questions
O365 Azure AD logging levels been changed?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 10%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDR%3C/text%3E%3C/svg%3E)
David Richards
1
Reputation point
Hi everyone
I work for an MSSP and we're seeing a drastic drop in O365 Azure AD log levels across all customers. I can't find any further information on MS forums or the Azure AD patch notes page, so thought I'd ask here.
Is anybody aware of the logging levels changing? Or any issue with O365 Azure AD?
The number of events processed by our SIEM for O365 Azure AD started dropping off on Wednesday and have been very low since.
Cheers,
Dai
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Marilee Turscak-MSFT 36,836 Reputation points Microsoft Employee2020-10-29T23:36:47.157+00:00 Hi @David Richards ,
If your licensing changed or expired, that could be the culprit. Also, certain types of logs such as directory audit and sign-in audit logs take longer to appear.
I would recommend visiting the guide, Troubleshoot: Missing data in the Azure Active Directory activity logs
What type of data is missing for you?
Once I have these details, I'm happy to reach out to the product team to ask if anything has changed and also troubleshoot with you over email if needed!
-
David Richards 1 Reputation point
2020-10-30T01:23:30.44+00:00 Hi @MarileeTurscak
Thank you for your response. Unfortunately I don't have any visibility into the customers' Azure environment. They have informed me that they have not made any changes to their Azure environment, although, as this is affecting all customers with Office 365 Azure AD it is unlikely to be caused by a customer change.
The SIEM vendor is also unaware of any changes made to the log collecting application.The data we're missing, as an example:
I would expect roughly 50,000 authentication/authorisation events per day. Consisting of events such as:
UserLoggedIn
UserLoginFailed
Add member to group.
Update user.
ETC.However, in the past 24 hours there are only 27 events, all of them 'UserLoggedIn' events. I have forwarded the link you provided to one of the customers to confirm if they can see the event logs locally.
Sign in to comment
Sign in to answer