Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Reference for MicrosoftServicePrincipalSignInLogs table in Azure Monitor Logs.
| Attribute | Value |
|---|---|
| Category | Audit, Security |
| Basic Logs Eligible | ✓ Yes |
| Ingestion API Supported | ✗ No |
| Azure Monitor Tables Reference | View Documentation |
Source: Azure Monitor documentation
| Column Name | Type | Description |
|---|---|---|
| _BilledSize | real | The record size in bytes |
| _IsBillable | string | Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account |
| AppId | string | Unique GUID representing the app ID in Entra ID. |
| AppOwnerTenantId | string | The tenant identifier of the owner of the application in Entra ID. |
| Category | string | Category of the sign-in event |
| CorrelationId | string | ID to provide sign-in trail |
| CreatedDateTime | datetime | Datetime of the sign-in activity. |
| DurationMs | long | The duration of the operation in milliseconds |
| OperationName | string | For sign-ins, this value is always Sign-in activity |
| OperationVersion | string | The REST API version that's requested by the client |
| ResourceDisplayName | string | Name of the resource that was authenticated to |
| ResourceGroup | string | Resource group for the logs |
| ResourceIdentity | string | ID of the resource that was authenticated to |
| ResourceOwnerTenantId | string | The tenant ID of the owner of the resource being authenticated to |
| ResourceServicePrincipalId | string | Service Principal Id of the resource |
| ResultSignature | string | The result of the sign-in. Can be either success or failure |
| ServicePrincipalCredentialKeyId | string | Key id of the service principal that initiated the sign-in |
| ServicePrincipalCredentialThumbprint | string | Thumbprint of the service principal that initiated the sign-in |
| ServicePrincipalId | string | ID of the service principal who initiated the sign-in |
| ServicePrincipalName | string | Service Principal Name of the service principal who initiated the sign-in |
| SourceSystem | string | The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics |
| TenantId | string | The Log Analytics workspace ID |
| TimeGenerated | datetime | The date and time of the event in UTC |
| Type | string | For sign-ins, this value is always MicrosoftServicePrincipalSignInLogs |
| UniqueTokenIdentifier | string | Unique token identifier for the request |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊