KQL Search

Query Details

Azure Portal Login Errors

Query

//Azure Portal login errors by User, IPAddr, City, State, code, and description

SigninLogs
| where TimeGenerated > ago(30d)
| where AppDisplayName == "Azure Portal"
| extend errorCode_ = tostring(Status.errorCode)
| where errorCode_ != "0"
| extend city_ = tostring(LocationDetails.city), state_ = tostring(LocationDetails.state)
| project UserDisplayName, IPAddress, city_, state_, errorCode_, ResultDescription

Explanation

This query retrieves login errors in the Azure Portal for the past 30 days. It includes information about the user, IP address, city, state, error code, and error description.