Query Details
Azure Portal Login Errors
Query
//Azure Portal login errors by User, IPAddr, City, State, code, and description SigninLogs | where TimeGenerated > ago(30d) | where AppDisplayName == "Azure Portal" | extend errorCode_ = tostring(Status.errorCode) | where errorCode_ != "0" | extend city_ = tostring(LocationDetails.city), state_ = tostring(LocationDetails.state) | project UserDisplayName, IPAddress, city_, state_, errorCode_, ResultDescription
Explanation
This query retrieves login errors in the Azure Portal for the past 30 days. It includes information about the user, IP address, city, state, error code, and error description.
Details
Rod Trent
Released: November 3, 2020
Tables
SigninLogs
Keywords
UserDisplayName,IPAddress,city_,state_,errorCode_,ResultDescription
Operators
whereago==extendtostring!=project