| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| AADTenantId |
|
String |
| AlternateSignInName |
The identification that the user provided to sign in. It may be the userPrincipalName but it’s also populated when a user signs in using other identifiers. |
String |
| AppDisplayName |
The application name displayed in the Azure Portal. |
String |
| AppId |
The application identifier in Azure Active Directory. |
String |
| AppliedConditionalAccessPolicies |
|
String |
| AppliedEventListeners |
Detailed information about the listeners, such as Azure Logic Apps and Azure Functions, that were triggered by the corresponding events in the sign-in event. |
Object |
| AuthenticationContextClassReferences |
Contains a collection of values that represent the conditional access authentication contexts applied to the sign-in. |
String |
| AuthenticationDetails |
The result of the authentication attempt and additional details on the authentication method. |
String |
| AuthenticationMethodsUsed |
The authentication methods used. Possible values: SMS, Authenticator App, App Verification code, Password, FIDO, PTA, or PHS. |
String |
| AuthenticationProcessingDetails |
Additional authentication processing details, such as the agent name in case of PTA/PHS or Server/farm name in case of federated authentication. |
String |
| AuthenticationProtocol |
Lists the protocol type or grant type used in the authentication. The possible values are: none, oAuth2, ropc, wsFederation, saml20, deviceCode. For authentications that use protocols other than the possible values listed, the protocol type is listed as none. |
String |
| AuthenticationRequirement |
This holds the highest level of authentication needed through all the sign-in steps, for sign-in to succeed. |
String |
| AuthenticationRequirementPolicies |
Sources of authentication requirement, such as conditional access, per-user MFA, identity protection, and security defaults. |
String |
| AutonomousSystemNumber |
The Autonomous System Number (ASN) of the network used by the actor. |
String |
| Category |
Type of threat indicator or breach activity identified by the alert |
String |
| ClientAppUsed |
The legacy client used for sign-in activity. For example: Browser, Exchange ActiveSync, Modern clients, IMAP, MAPI, SMTP, or POP. |
String |
| ConditionalAccessPolicies |
A list of conditional access policies that are triggered by the corresponding sign-in activity. |
Object |
| ConditionalAccessStatus |
The status of the conditional access policy triggered. Possible values: success, failure, or notApplied. |
String |
| CorrelationId |
The identifier that’s sent from the client when sign-in is initiated. This is used for troubleshooting the corresponding sign-in activity when calling for support. |
String |
| CreatedDateTime |
The date and time the sign-in was initiated. The Timestamp type is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. |
DateTime |
| CrossTenantAccessType |
Describes the type of cross-tenant access used by the actor to access the resource. |
String |
| DeviceDetail |
The device information from where the sign-in occurred. Includes information such as deviceId, OS, and browser. |
Object |
| DurationMs |
|
Int64 |
| FlaggedForReview |
During a failed sign in, a user may click a button in the Azure portal to mark the failed event for tenant admins. If a user clicked the button to flag the failed sign in, this value is true. |
Boolean |
| HomeTenantId |
The tenant identifier of the user initiating the sign in. Not applicable in Managed Identity or service principal sign ins. |
String |
| Id |
The identifier representing the sign-in activity. |
String |
| Identity |
The display name of the actor identified in the signin. |
String |
| IPAddress |
The IP address of the client from where the sign-in occurred. |
String |
| IPAddressFromResourceProvider |
The IP address a user used to reach a resource provider, used to determine Conditional Access compliance for some policies. For example, when a user interacts with Exchange Online, the IP address Exchange receives from the user may be recorded here. This value is often null. |
String |
| IsInteractive |
Indicates whether a user sign in is interactive. In interactive sign in, the user provides an authentication factor to Azure AD. These factors include passwords, responses to MFA challenges, biometric factors, or QR codes that a user provides to Azure AD or an associated app. In non-interactive sign in, the user doesn’t provide an authentication factor. Instead, the client app uses a token or code to authenticate or access a resource on behalf of a user. Non-interactive sign ins are commonly used for a client to sign in on a user’s behalf in a process transparent to the user. |
Boolean |
| IsRisky |
|
Boolean |
| Level |
|
String |
| Location |
The 2 letter country code from where the sign-in occurred. Depending on IP address provided, this value may not always resolve to a city or region level of detail. |
String |
| LocationDetails |
Provides the city, state, country/region and latitude and longitude from where the sign-in happened. |
Object |
| MfaDetail |
This property is deprecated. |
Object |
| NetworkLocationDetails |
The network location details including the type of network used and its names. |
String |
| OperationName |
Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation |
String |
| OperationVersion |
|
String |
| OriginalRequestId |
The request identifier of the first request in the authentication sequence. |
String |
| ProcessingTimeInMilliseconds |
|
String |
| Resource |
|
String |
| ResourceDisplayName |
The name of the resource that the user signed in to. |
String |
| ResourceGroup |
|
String |
| ResourceId |
The identifier of the resource that the user signed in to. |
String |
| ResourceIdentity |
The resource that the user signed in to. |
String |
| ResourceProvider |
|
String |
| ResourceServicePrincipalId |
The identifier of the service principal representing the target resource in the sign-in event. |
String |
| ResourceTenantId |
The tenant identifier of the resource referenced in the sign in. |
String |
| ResultDescription |
Provides the error message or the reason for failure for the corresponding sign-in activity. |
String |
| ResultSignature |
|
String |
| ResultType |
Provides the 5-6 digit error code that’s generated during a sign-in event. 0 indicates success; other values are failures. You can find more information using the Azure AD Error Codes documentation or https://login.microsoftonline.com/error. |
String |
| RiskDetail |
The reason behind a specific state of a risky user, sign-in, or a risk event. Possible values: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, or adminConfirmedSigninCompromised. The value none means that no action has been performed on the user or sign-in so far. Note: Details for this property are only available for Azure AD Premium P2 customers. All other customers are returned hidden. |
String |
| RiskEventTypes |
This property is deprecated. |
String |
| RiskEventTypes_V2 |
The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, or generic. |
String |
| RiskLevel |
The AAD risk level (Low/Medium/High) of the user account |
String |
| RiskLevelAggregated |
The aggregated risk level. Possible values: none, low, medium, high, or hidden. The value hidden means the user or sign-in was not enabled for Azure AD Identity Protection. Note: Details for this property are only available for Azure AD Premium P2 customers. All other customers are returned hidden. |
String |
| RiskLevelDuringSignIn |
The risk level during sign-in. Possible values: none, low, medium, high, or hidden. The value hidden means the user or sign-in was not enabled for Azure AD Identity Protection. Note: Details for this property are only available for Azure AD Premium P2 customers. All other customers are returned hidden. |
String |
| RiskState |
The risk state of a risky user, sign-in, or a risk event. Possible values: none, confirmedSafe, remediated, dismissed, atRisk, or confirmedCompromised. |
String |
| ServicePrincipalId |
The application identifier used for sign-in. This field is populated when you are signing in using an application. |
String |
| ServicePrincipalName |
The application name used for sign-in. This field is populated when you are signing in using an application. |
String |
| SessionLifetimePolicies |
Any conditional access session management policies that were applied during the sign-in event. |
String |
| SignInIdentifier |
The identification that the user provided to sign in. It may be the userPrincipalName but it’s also populated when a user signs in using other identifiers. |
String |
| SignInIdentifierType |
The type of sign in identifier. Possible values are: userPrincipalName, phoneNumber, proxyAddress, qrCode, onPremisesUserPrincipalName. |
String |
| SourceSystem |
|
String |
| Status |
The sign-in status. Includes the error code and description of the error (in case of a sign-in failure). |
Object |
| TimeGenerated |
|
DateTime |
| TokenIssuerName |
The name of the identity provider. For example, sts.microsoft.com. |
String |
| TokenIssuerType |
The type of identity provider. The possible values are: AzureAD, or ADFederationServices, AzureADBackupAuth, ADFederationServicesMFAAdapter, NPSExtension. |
String |
| Type |
The name of the table |
String |
| UniqueTokenIdentifier |
A unique base64 encoded request identifier used to track tokens issued by Azure AD as they are redeemed at resource providers. |
String |
| UserAgent |
The user agent information related to sign-in. |
String |
| UserDisplayName |
The display name of the user. |
String |
| UserId |
The identifier of the user. |
String |
| UserPrincipalName |
The UPN of the user. |
String |
| UserType |
Identifies whether the user is a member or guest in the tenant. Possible values are: member and guest. |
String |