Queries for the AADProvisioningLogs table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Shows the number of users and groups created, updated, disabled, and deleted in the past 7 days.

AADProvisioningLogs
| where TimeGenerated > ago(7d)
| where ResultType == "Success"
| parse SourceIdentity with * "\"identityType\":\"" Type "\"" *
| extend Type = tolower(Type)
| summarize count() by Type, Action
| order by Type, Action

Shows the count per error code and when were they last seen.

AADProvisioningLogs
| where ResultType == "Failure"
| summarize Occurrences=count(), LastSeen=max(TimeGenerated) by ResultSignature
| order by LastSeen

Summarizes for each day the number of created objects per day.

AADProvisioningLogs
| where TimeGenerated > ago(7d)
| where ResultType == "Success"
| where Action == "Create"
| parse SourceIdentity with * "\"identityType\":\"" Type "\"" *
| extend Type = tolower(Type)
| summarize count() by Type, bin(TimeGenerated, 1d)
| render columnchart