| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| AlternateSignInName |
Provides the on-premises UPN of the user sign-ing into Azure AD.e.g. Phone number sign-in. |
String |
| AppDisplayName |
App name displayed in the Azure portal. |
String |
| AppId |
Unique GUID representing the app ID in the Azure Active Directory. |
String |
| AppliedEventListeners |
Detailed information about the applied event listeners or listeners that are triggered by the corresponding events in an authentication activity. It’s called appliedEventListeners in ALP and MSGraph, but use Authentication Events to match name on UX. |
Object |
| AuthenticationContextClassReferences |
The authentication contexts of the sign-in. |
String |
| AuthenticationDetails |
A record of each step of authentication undertaken in the sign-in. |
String |
| AuthenticationMethodsUsed |
List of authentication methods used. |
String |
| AuthenticationProcessingDetails |
Provides the details associated with authentication processor. |
String |
| AuthenticationProtocol |
Lists the protocol type or grant type used in the authentication. The possible values are: none, oAuth2, ropc, wsFederation, saml20, deviceCode, unknownFutureValue. For authentications that use protocols other than the possible values listed, the protocol type is listed as none. |
String |
| AuthenticationRequirement |
Type of authentication required for the sign-in. If set to multiFactorAuthentication, an MFA step was required. If set to singleFactorAuthentication, no MFA was required. |
String |
| AuthenticationRequirementPolicies |
Set of CA policies that apply to this sign-in, each as CA: policy name, and/or MFA: Per-user. |
String |
| AutonomousSystemNumber |
Autonomous System Number for the network. |
String |
| Category |
Category of the sign-in event. |
String |
| ClientAppUsed |
Details outlining app auth used (Legacy vs non Legacy) Eg: Modern Browser, Native App, Exchange Activty Sync and Older Clients. |
String |
| ConditionalAccessPolicies |
Details of the conditional access policies being applied for the sign-in. |
String |
| ConditionalAccessStatus |
Status of all the conditionalAccess policies related to the sign-in. |
String |
| CorrelationId |
ID to provide sign-in trail. |
String |
| CreatedDateTime |
Datetime of the sign-in activity. |
DateTime |
| CrossTenantAccessType |
Describes the type of cross-tenant access used by the actor to access the resource. Possible values are: none, b2bCollaboration, b2bDirectConnect, microsoftSupport, serviceProvider, unknownFutureValue. If the sign in did not cross tenant boundaries, the value is none. |
String |
| DeviceDetail |
Details of the device used for the sign-in. |
String |
| DurationMs |
The duration of the operation in milliseconds. |
Int64 |
| HomeTenantId |
The home tenant ID for cross-tenant scenarios. |
String |
| Id |
Unique ID representing the sign-in activity. |
String |
| Identity |
The identity from the token that was presented when you made the request. It can be a user account, system account, or service principal. |
String |
| IPAddress |
IP address of the client used to sign in. |
String |
| IsInteractive |
Indicates if a sign-in is interactive or not. |
Boolean |
| IsRisky |
Indicates if a sign-in is considered risky or not. |
Boolean |
| Level |
The severity level of the event. |
String |
| Location |
The region of the resource emitting the event. |
String |
| LocationDetails |
Details of the sign-in location. |
String |
| MfaDetail |
Details of the Multi-factor authentication. |
String |
| NetworkLocationDetails |
Provides the details associated with authentication processor. |
String |
| OperationName |
For sign-ins, this value is always Sign-in activity. |
String |
| OperationVersion |
The REST API version that’s requested by the client. |
String |
| OriginalRequestId |
The request id of the first request in the authentication sequence. |
String |
| ProcessingTimeInMs |
Request processing time in milliseconds in AD STS. |
String |
| ResourceDisplayName |
Name of the resource that the user signed into. |
String |
| ResourceGroup |
Resource group for the logs. |
String |
| ResourceIdentity |
ID of the resource that the user signed into. |
String |
| ResourceServicePrincipalId |
Service Principal Id of the resource. |
String |
| ResourceTenantId |
The resource tenant ID for cross-tenant scenarios. |
String |
| ResultDescription |
Provides the error description for the sign-in operation. |
String |
| ResultSignature |
Contains the error code, if any, for the sign-in operation. |
String |
| ResultType |
The result of the sign-in operation can be Success or Failure. |
String |
| RiskDetail |
Risky user state details. |
String |
| RiskEventTypes |
The list of risk event types associated with the sign-in. |
String |
| RiskEventTypes_V2 |
The list of risk event types associated with the sign-in. These are strings. |
String |
| RiskLevelAggregated |
Aggregated risk level. |
String |
| RiskLevelDuringSignIn |
Risk level during sign-in. |
String |
| RiskState |
Risky user state. |
String |
| ServicePrincipalId |
ID of the service principal who initiated the sign-in. |
String |
| SessionLifetimePolicies |
Policies and settings that applied to the sign-in that enforced or revoked a session lifetime. |
String |
| SignInEventTypes |
The types that are associated with the sign-in. Examples include “interactive”, “refreshToken”, “managedIdentity”, “continuousAccessEvaluation” and many more. |
String |
| SignInIdentifierType |
The type of sign in identifier. Possible values are: userPrincipalName, phoneNumber, proxyAddress, qrCode, onPremisesUserPrincipalName, unknownFutureValue. |
String |
| SourceSystem |
Details of source system of the object being provisioned. |
String |
| Status |
Details of the sign-in status. |
String |
| TenantId |
|
String |
| TimeGenerated |
The date and time of the event in UTC. |
DateTime |
| TokenIssuerName |
Name of the identity provider (e.g. sts.microsoft.com ). |
String |
| TokenIssuerType |
Type of identityProvider (Azure AD, AD Federation Services). |
String |
| Type |
The name of the table |
String |
| UniqueTokenIdentifier |
Unique token identifier for the request. |
String |
| UserAgent |
User Agent for the sign-in. |
String |
| UserDisplayName |
Display name of the user that initiated the sign-in. |
String |
| UserId |
ID of the user that initiated the sign-in. |
String |
| UserPrincipalName |
User principal name of the user that initiated the sign-in. |
String |
| UserType |
Identifies whether the user is a member or guest in the tenant. Possible values are: member, guest, unknownFutureValue. |
String |