Azure AD B2C Audit Logs - Graph API - query options not working

user_2549916 0
Viewed 553

I am trying to retrieve the Azure AD user sign-in audit logs for our tenant. For this, I am using [Microsoft’s graph APIs][1]

https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=createdDateTime ge 2019-10-08T09:00:00.0000000 and createdDateTime le 2019-10-08T09:12:00.0000000

In the above-given example, I am trying to filter the logs based on a query option, $filter where I am trying to retrieve the records based on createDateTime,

from Date 2019-10-08T09:00:00.0000000 and to date 2019-10-08T09:12:00.0000000.

Every time I am getting the records from the current time and going back in history. This means, irrespective of any date range I provide, it gets ignored.

For that matter when I apply any OData (https://docs.microsoft.com/en-us/graph/query-parameters#odata-system-query-options) query options ($top, $orderby, etc), the API still returns with the latest audit logs and none of the query options seems to work.

Could this be due to the permissions or the license? Any help is much appreciated.

With the given date ranges I should be able to get the audit logs between the ranges.

azure-ad-b2c asp.net-core filter
2 Answers

It works as expected on my side and I don't think it is related with the permissions. Can you paste your whole request here?

Here is mine request:

https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=createdDateTime le 2019-10-08T09:00:00.0000000Z&$top=1

You can have a try with this one. You can test it by using microsoft graph explorer.

One more thing, we should use /v1.0 instead of /beta version.

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported.

user_105049990

I finally found the answer. I was sending the encoded(HttpUtility.UrlEncode) version of the query options part of the Url, which Graph API doesn’t like for some reason.

user_25499160
Related