Skip to main content
Sumo Logic

Install the Azure Active Directory App and View the Dashboards

Install the Sumo Logic App

Now that you have set up collection for the Azure Active Directory, install the Sumo Logic App to use the pre-configured searches and dashboards that provide visibility into your environment for real-time analysis of overall usage.

To install the app:

This page contains information on how to install the Sumo Logic app, as well as descriptions of the dashboards found in the Azure Active Directory app.

Locate and install the app you need from the App Catalog. If you want to see a preview of the dashboards included with the app before installing, click Preview Dashboards.

  1. From the App Catalog, search for and select the app. 
  2. To install the app, click Add to Library and complete the following fields.
    1. App Name. You can retain the existing name, or enter a name of your choice for the app.

    2. Data Source. Select either of these options for the data source.

      • Choose Source Category, and select a source category from the list.

      • Choose Enter a Custom Data Filter, and enter a custom source category beginning with an underscore. Example: (_sourceCategory=MyCategory).

    3. Advanced. Select the Location in Library (the default is the Personal folder in the library), or click New Folder to add a new folder.
    4. Click Add to Library.

Once an app is installed, it will appear in your Personal folder, or other folder that you specified. From here, you can share it with your organization. See Welcome to the New Library for information on working with the library in the new UI.

Panels will start to fill automatically. It's important to note that each panel slowly fills with data matching the time range query and received since the panel was created. Results won't immediately be available, but with a bit of time, you'll see full graphs and maps. 

Dashboards

Azure Active Directory - Overview

See an overview of Azure Active Directory activity, including operation names, audit event categories, log levels, and result types.

azure ad overview dashboard.png

Operation Name. Shows the name of operations, and a count of how many times they happened on a bar chart, for the last 24 hours.

Operation Name - One Day Time Comparison. Shows an aggregation table with the names of operations that have happened in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Log Level Breakdown. Shows a breakdown of the level of logs on a pie chart for the last 24 hours.

Audit Event Category Breakdown. Shows a breakdown of the category of audit events along with a count on a bar chart for the last 24 hours.

Audit Event Category - One Day Time Comparison. Shows an aggregation table with the categories of audit events in the last 24 hours along with a count, and compares it to the count of categories from one day before.

ResultType Breakdown. Shows a breakdown of the types of results (success or failure) on a pie chart, for the last 24 hours.

Geo Location of Events. Performs a geo lookup query and displays the location and number of events on a map of the world for the last 24 hours.

Category Breakdown. Shows a breakdown of the categories on a pie chart for the last 24 hours.

Azure Active Directory - Role Management

See information about role management in Azure Activity Directory, including role updates, successful events, and users added or removed from roles.Azure Active Directory - Role Management.pngOperation Name. Shows the name of role management operations, and a count of how many times they happened on a bar chart, for the last 24 hours.

Operation Name - One Day Time Comparison. Shows an aggregation table with the names of role management operations that have happened in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Operation Name Over Time. Shows a count of role management operations along with the name on a line chart for the last 24 hours.

Failed Events. Shows an aggregation table of failed events with columns for the operation names, result types, result description identity, and count for the last 24 hours.

Successful Events. Shows an aggregation table of successful events with columns for the operation names, result types, result description identity, target name, and target source name for the last 24 hours.

Breakdown by Results. Shows a breakdown of the types of results (success or failure) on a pie chart, for the last 24 hours.

Role Updates. Shows an aggregation table of role updates with columns for the operation names, result types, result description identity, role name, target source name, and count for the last 24 hours.

Added/Removed User from Role. Shows an aggregation table of users added or removed from a role with columns for the operation names, result types, result description identity, user name, and target source name for the last 24 hours.

Azure Active Directory - User Management

See information about user management in Azure Activity Directory, including external user invites, updated and deleted users, users added and outliers in user management events.

Azure Active Directory - User Management.png

Operation Name. Shows the name of user management operations, and a count of how many times they happened on a bar chart, for the last 24 hours.

Operation Name - One Day Time Comparison. Shows an aggregation table with the names of user management operations that have happened in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Operation Name Over Time. Shows a count of user management operations along with the name on a line chart for the last 24 hours.

Failed Events. Shows an aggregation table of failed events with columns for the operation names,  result types, result descriptions, identity, and count for the last 24 hours.

Successful Events. Shows an aggregation table of successful events with columns for the operation names, identity, result types, and count for the last 24 hours.

Breakdown by Results. Shows a breakdown of the types of results (success or failure) on a pie chart, for the last 24 hours.

Invite External User. Shows an aggregation table of successful events with columns for the time, operation names, result types, target source name, identity, result description, and count for the last 24 hours.

Add User. Shows an aggregation table of added users with columns for the time, operation names, result types, target source name, identity, and count for the last 24 hours.

Updated User. Shows an aggregation table of updated users with columns for the time, operation names, result types, target source name, identity, and count for the last 24 hours.

Deleted User. Shows an aggregation table of deleted users with columns for the time, operation names, result types, target source name, identity, and count for the last 24 hours.

User Management Events - Outlier. Shows outliers in user management events with count and thresholds on a line chart, for the last 24 hours.

Azure Active Directory - Application Management

See information about application management in Azure Activity Directory, including application consent, deleted applications, applications added or updated, and service principal updates.

Azure Active Directory - Application Management.png

Operation Name. Shows the name of application management operations, and a count of how many times they happened on a bar chart, for the last 24 hours.

Operation Name - One Day Time Comparison. Shows an aggregation table with the names of application management operations that have happened in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Operation Name Over Time. Shows a count of application management operations along with the name on a line chart for the last 24 hours.

Failed Events. Shows an aggregation table of failed events with columns for the operation names,  result types, result descriptions, identity, and count for the last 24 hours.

Successful Events. Shows an aggregation table of successful events with columns for the operation names,  result types, result descriptions, identity, and count for the last 24 hours.

Breakdown by Results. Shows a breakdown of the types of results (success or failure) on a pie chart, for the last 24 hours.

Application Management Events - Outlier. Shows outliers in application management events with count and thresholds on a line chart, for the last 24 hours.

Deleted Applications. Shows an aggregation table of deleted applications with columns for the operation names, result types, result descriptions, identity, target source name, and count for the last 24 hours.

Service Principal Updates. Shows an aggregation table of service principal updates with columns for the operation names, result types, result descriptions, identity, target source name, and count for the last 24 hours.

Consent Given to Application. Shows an aggregation table of consent given to applications with columns for the operation names,result types, result descriptions, identity, target source name, and count for the last 24 hours.

Applications Added or Updated. Shows an aggregation table of applications added or updated with columns for the operation names, result types, result descriptions, identity, target source name, and count for the last 24 hours.

Azure Active Directory - Directory Management

See information about directory management in Azure Activity Directory, including failed events, successful events, and disables desktop SSOs.Azure Active Directory - Directory Management.pngOperation Name. Shows the name of directory management operations, and a count of how many times they happened on a bar chart, for the last 24 hours.

Operation Name - One Day Time Comparison. Shows an aggregation table with the names of directory management operations that have happened in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Operation Name Over Time. Shows a count of directory management operations along with the name on a line chart for the last 24 hours.

Failed Events. Shows an aggregation table of failed events with columns for the operation names,  result types, result descriptions, identity, and count for the last 24 hours.

Successful Events. Shows an aggregation table of successful events with columns for the operation names, result types, result descriptions, identity, and count for the last 24 hours.

Breakdown by Results. Shows a breakdown of the types of results (success or failure) on a pie chart, for the last 24 hours.

Disable Desktop SSO. Shows an aggregation table of disabled desktop SSOs with columns for the operation names, result types, result descriptions, identity, target source name, and count for the last 24 hours.

Azure Active Directory - Group Management

See information about group management in Azure Activity Directory, including groups added, and a list of members added or removed from groups.

Azure Active Directory - Group Management.png

Operation Name. Shows the name of group management operations, and a count of how many times they happened on a bar chart, for the last 24 hours.

Operation Name - One Day Time Comparison. Shows an aggregation table with the names of group management operations that have happened in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Operations Over Time.  Shows a count of group management operations along with the name on a line chart for the last 24 hours.

Failed Events. Shows an aggregation table of failed events with columns for the operation names,  result types, result descriptions, identity, and count for the last 24 hours.

Successful Events. Shows an aggregation table of successful events with columns for the operation names,  result types, result descriptions, identity, and count for the last 24 hours.

Members Added/Removed. Shows an aggregation table of successful events with columns for the time, operation names,  result types, target source name, identity, display name, and count for the last 24 hours.

Groups Added. Shows an aggregation table of groups added with columns for the time, operation names, result types, target source name, identity, and count for the last 24 hours.

Breakdown by Results. Shows a breakdown of the types of results (success or failure) on a pie chart, for the last 24 hours.

Azure Active Directory - Authorization/Authentication/Other

See information about Authorization in Azure Active Directory including the name of authorization operations done, successful and failed authorization events, and breakdown of results.

Azure Active Directory - Authorization_Authentication_Other.png

Operation Name. Shows the name of authorizations or authentication, and a count of how many times they happened on a bar chart, for the last 24 hours.

Operation Name - One Day Time Comparison.  Shows an aggregation table with the names of authorizations or authentication that have happened in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Operations Over Time. Shows a count of authorizations or authentication along with the name on a line chart for the last 24 hours.

Successful Events. Shows an aggregation table of successful events with columns for the operation names,  result types, result descriptions, target source name, identity, and count for the last 24 hours.

Failed Events. Shows an aggregation table of failed events with columns for the operation names,  result types, result descriptions, identity, target source name, and count for the last 24 hours.

Breakdown by Results. Shows a breakdown of the types of results (success or failure) on a pie chart, for the last 24 hours.

Azure Active Directory - Successful Sign-In Events

See information about successful sign-in events in your Azure AD, including the geo-location of sign-in activity, risky sign-ins, breakdown by browser & application, and any anomalies in the login count.

azure ad successful sign-in events.png

Geo Location of Sign-in. Performs a geo lookup query and displays the location and number of successful sign-in events on a map of the world for the last 24 hours.

Sign-In by User - One Day Time Comparison. Shows an aggregation table with the names of users with successful sign-in events in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Breakdown by OS. Shows breakdown of the operating system that is the source of sign-in events.

Risky Sign In. Shows risky successful sign-in events.

Top 10 Active Users. Shows top 10 active users with successful sign-ins.

Break Down by Browser. Shows breakdown of the browser that is the source of sign-in events.

Sign In by User Over Time. Shows trend of successful sign-in events over time.

Breakdown by Country, State, City. Shows breakdown by country, state, and city.

Sign in by Application. Shows successful sign-in events by Application.

Anomaly in Total Login Count. Shows any Anomaly in the total successful login count over 7 days.

Azure Active Directory - Failure Sign-in Events

See information about failure sign-in events in your Azure AD, including the geo-location of sign-in activity, risky sign-ins, breakdown by browser & application, and any anomalies in the login count.

azure ad failure sign-in event.png

Geo Location of Sign-in. Performs a geo lookup query and displays the location and number of failure sign-in events on a map of the world for the last 24 hours.

Sign-In by User - One Day Time Comparison. Shows an aggregation table with the names of users with failed sign-in events in the last 24 hours along with a count, and compares it to the count of operations from one day before.

Breakdown by OS. Shows breakdown of the operating system that is the source of sign-in events.

Failure Sign In Table. Shows an aggregation table of failure sign-in events with columns for the date time, identity,  error code, description, IP address, state, city, country, and source application name with the count for the last 24 hours.

Risky Sign In. Shows risky failure sign-in events.

Top 10 Active Users. Shows top 10 active users with failure sign-in events.

Break Down by Browser. Shows breakdown of the browser that is the source of sign-in events.

Sign In by User Over Time. Shows trend of failure sign-in events over time.

Breakdown by Country, State, City. Shows breakdown by country, state, and city.

Sign in by Application. Shows failure sign-in events by Application.

Anomaly in Total Login Count. Shows any Anomaly in the total failure login count over 7 days.