0
(0)

 Important

The AADSpnSignInEventsBeta table is currently in beta and is being offered on a short-term basis to allow you to hunt through Azure Active Directory (AAD) sign-in events. Customers need to have an Azure Active Directory Premium P2 license to collect and view activities for this table. Microsoft will eventually move all sign-in schema information to the IdentityLogonEvents table.

The AADSpnSignInEventsBeta table in the advanced hunting schema contains information about Azure Active Directory service principal and managed identity sign-ins. You can learn more about the different kinds of sign-ins in Azure Active Directory sign-in activity reports – preview.

Use this reference to construct queries that return information from the table.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.


TABLE 1
Column name Data type Description
Timestamp datetime Date and time when the record was generated
Application string Application that performed the recorded action
ApplicationId string Unique identifier for the application
IsManagedIdentity boolean Indicates whether the sign-in was started by a managed identity
ErrorCode int Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes.
CorrelationId string Unique identifier of the sign-in event
ServicePrincipalName string Name of the service principal that started the sign-in
ServicePrincipalId string Unique identifier of the service principal that started the sign-in
ResourceDisplayName string Display name of the resource accessed
ResourceId string Unique identifier of the resource accessed
ResourceTenantId string Unique identifier of the tenant of the resource accessed
IPAddress string IP address assigned to the endpoint and used during related network communications
Country string Two-letter code indicating the country where the client IP address is geolocated
State string State where the sign-in occurred, if available
City string City where the account user is located
Latitude string The north to south coordinates of the sign-in location
Longitude string The east to west coordinates of the sign-in location
RequestId string Unique identifier of the request
ReportId string Unique identifier for the event

Source : Official Microsoft Brand
Editor by : BEST Antivirus KBS Team

How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.