Query

SigninLogs
| where ResultDescription has "Conditional Access"
| summarize Total = count() by ResultType, ResultDescription
| render barchart with(title="Conditional Access Failures")

About this query

Visualization SignIn Failures due to Conditional Access Policy

Query Information

Description

This visualisation will return the failure types that occur in your tenant that are related to any conditional access failure. This can be used to deterime which failures are related to a policy and if strange activity is being performed or if a policy needs to be tuned in a specific manner.

References

https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-error-codes

Sentinel

Explanation

This query is designed to help visualize and understand the types of sign-in failures in your system that are specifically related to Conditional Access policies. Here's a simple breakdown of what the query does:

Data Source: It uses the SigninLogs, which contains records of sign-in attempts.
Filter: It filters the logs to only include entries where the ResultDescription contains the phrase "Conditional Access". This means it focuses on failures that are related to Conditional Access policies.
Summarization: It counts the number of occurrences of each type of failure (ResultType) and groups them by ResultType and ResultDescription. This helps identify which specific failures are happening and how often.
Visualization: The results are displayed as a bar chart titled "Conditional Access Failures", making it easy to see which failure types are most common.

Overall, this query helps you identify and analyze sign-in failures related to Conditional Access policies, which can be useful for detecting unusual activity or determining if your policies need adjustments.

KQL Search