Mar 20 2024 05:33 AM
Hi Everyone, i ask you a question from basilar KQL " SigninLogs | Project Id,UserId,Identity" i receive correctly the events, but in some case in the Identity coloum receive an ID in this format xxxx-xxxxx-xxxx and not the Disaplay Name ?
Why ?
Many Thanks,
Guido
Mar 20 2024 07:59 AM
Mar 20 2024 09:28 AM
Solution
Identity is the actor logging in which can be the GUID of an App
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs
Check the AppDisplayName
e.g.
Mar 27 2024 01:20 AM
Mar 29 2024 07:21 AM
@gaudium91 usually this will happen when the sign-in activity is not completely succesful, look at the result type, just remember to summarize or filter by UserId if you want ALL activity to appear.
Mar 20 2024 09:28 AM
Solution
Identity is the actor logging in which can be the GUID of an App
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs
Check the AppDisplayName
e.g.