Understanding Authentication Data about o365beat HOT 4 CLOSED

Good point.

Microsoft's documentation makes a reference to this here: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#common-schema

See the point on ResultStatus.

I did some testing on this as well and I don't think using ExtendedProperties is reliable in determining whether the logon was successful or not. For example - I see some events where the ResultStatusDetail is "Success" but a LogonError property still exists with a value of KmsiInterrupt which is documented here: https://docs.microsoft.com/en-gb/azure/active-directory/develop/reference-aadsts-error-codes#aadsts-error-codes

I haven't seen any events where the LogonError property exists (except for when the value is "None") but the even't isn't an authentication failure so maybe that's the most reliable way.

from o365beat.

Actually it looks like LogonError is always "None" for Logout events but LogonError "None" also seems to exists for some successful login events (not sure why this is the case).

So you could filter for successfuly authentication events by searching for events where Operation = UserLoggedIn and LogonError doesn't exist or equals to "None" and ExtendedProerties doesn't contain "Logout"

from o365beat.

Thank you for this issue, and for the discussion! I'd love to consolidate these lessons and move them to the right location. I'll try to distill and capture this in a section in the README soon, with a link to this issue. I'll let you know when that happens, I don't want to close this until we have a good place to direct curious folks.

from o365beat.

Referenced in README in release v1.5.1, and we can keep this (closed) issue for reference and any additional discussion. Thanks again!

from o365beat.