Azure Portal Login Errors
Query
//Azure Portal login errors by User, IPAddr, City, State, code, and description
SigninLogs
| where TimeGenerated > ago(30d)
| where AppDisplayName == "Azure Portal"
| extend errorCode_ = tostring(Status.errorCode)
| where errorCode_ != "0"
| extend city_ = tostring(LocationDetails.city), state_ = tostring(LocationDetails.state)
| project UserDisplayName, IPAddress, city_, state_, errorCode_, ResultDescriptionExplanation
This query retrieves login errors in the Azure Portal for the past 30 days. It includes information about the user, IP address, city, state, error code, and error description.
Details
Rod Trent
Released: November 3, 2020
Tables
SigninLogs
Keywords
UserDisplayNameIPAddresscity_state_errorCode_ResultDescription
Operators
whereago==extendtostring!=project