Get-AzureADAuditSignInLogs - cannot find object "User Agent"

Blue Tongue 1 Reputation point
2022-04-10T13:06:44.757+00:00

Hello all,

In O365 admin center, when I went to display "Exchange Active Sync" in Azure Sign-in logs, I was able to find a useful field called "User Agent" (in Basic info tab) like below.
191570-zzzzzz.jpg

However, when I used Powershell cmdlet Get-AzureADAuditSignInLogs to dump the log out, there is no such field.
There is only a DeviceDetail field like below.

Can someone please verify for me?

DeviceDetail                     : class SignInAuditLogObjectDeviceDetail {  
                                     DeviceId: daa00f9d-12e7-4684-a8b8-25bced93a663  
                                     DisplayName: Mick’s phone  
                                     OperatingSystem: Ios  
                                     Browser: Mobile Safari  
                                     IsCompliant: True  
                                     IsManaged: True  
                                     TrustType: Azure AD registered  
                                   }  
Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments No comments

2 answers

Sort by: Most helpful
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    5 deleted comments

    Comments have been turned off. Learn more

  2. Vasil Michev 128.4K Reputation points MVP Volunteer Moderator
    2022-04-10T14:44:46.537+00:00

    The Azure AD module is a bit outdated, best use the MS Graph SDK, or call the Graph API https://graph.microsoft.com/beta/auditLogs/signIns endpoint directly - you will see the User agent string therein.

    Was this answer helpful?


Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.