Powershell Get-AzureADAuditSignInLogs not returning as many logs as expected

user_17834612 0
Viewed 1638

I'm using Powershell to grab SignInLogs from Azure AD. As far as I understand, SignInLogs are archived for a rolling period of 7 days in Azure. However, when I use this method I only get 960 individual sign in logs back. There should be a lot more if it's going back 7 days (I looked into it and there are sometimes over 960 new sign-ins about every 10 minutes). Is there a limit to the number of logs you can pull with Powershell this way? Or, is there a way to specify a greater historical period for getting the logs?

Here's the Powershell command:

Connect-AzureAD -AccountId me@company.com 
Get-AzureADAuditSignInLogs

Edit: I've tried specifying an earlier start date but still getting the same number of logs:

Connect-AzureAD -AccountId me@company.com 
Get-AzureADAuditSignInLogs -Filter "createdDateTime gt 2022-02-03"
audit-logging azure-storage-account azure-active-directory azure powershell
1 Answers

This seems to be an ongoing issue. Couple of users have reported the same issue @ github. Would suggest you to please reach out to MS support team.

user_158868100
Related