Skip to content

Commit

Permalink
Merge pull request #5953 from MicrosoftDocs/main
Browse files Browse the repository at this point in the history
11/13/2024 PM Publish
  • Loading branch information
Taojunshen authored Nov 13, 2024
2 parents 2b10b78 + 2aa52d0 commit f6ff869
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 16 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -53,19 +53,19 @@ To search for specific activity log entries, use the $filter and createdDateTime
Try using the following queries:

- For sign-in attempts where Conditional Access failed:
- GET `https://graph.microsoft.com/v1.0/auditLogs/signIns?&$filter=conditionalAccessStatus eq 'failure'`
- GET `https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=conditionalAccessStatus eq 'failure'`

- To find sign-ins to a specific application:
- GET `https://graph.microsoft.com/v1.0/auditLogs/signIns?&$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z) and appId eq 'APP ID'`
- GET `https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z) and appId eq 'APP ID'`

- For non-interactive sign-ins:
- GET `https://graph.microsoft.com/beta/auditLogs/signIns?&$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z) and signInEventTypes/any(t: t eq 'nonInteractiveUser')`
- GET `https://graph.microsoft.com/beta/auditLogs/signIns?$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z) and signInEventTypes/any(t: t eq 'nonInteractiveUser')`

- For service principal sign-ins:
- GET `https://graph.microsoft.com/beta/auditLogs/signIns?&$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z) and signInEventTypes/any(t: t eq 'servicePrincipal')`
- GET `https://graph.microsoft.com/beta/auditLogs/signIns?$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z) and signInEventTypes/any(t: t eq 'servicePrincipal')`

- For managed identity sign-ins:
- GET `https://graph.microsoft.com/beta/auditLogs/signIns?&$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z) and signInEventTypes/any(t: t eq 'managedIdentity')`
- GET `https://graph.microsoft.com/beta/auditLogs/signIns?$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z) and signInEventTypes/any(t: t eq 'managedIdentity')`

- To get the authentication method of a user:
- GET `https://graph.microsoft.com/beta/users/{userObjectId}/authentication/methods`
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ description: Learn how to access the sign-in log and analyze a single sign-in at
ms.service: entra-id
ms.subservice: monitoring-health
ms.topic: quickstart
ms.date: 11/04/2024
ms.date: 11/13/2024
ms.author: sarahlipsey
author: shlipsey3
manager: amycolannino
Expand Down Expand Up @@ -47,7 +47,7 @@ This section provides the steps to locate the failed sign-in attempt using the M

1. Set the API version to **beta**.

1. Select **Run query**.
1. Enter the following query and select **Run query**: `https://graph.microsoft.com/beta/auditLogs/signIns?$top=10&$filter=userDisplayName eq 'Isabella Simonsen'`

1. Review the query response and locate the **status** section of the response.

Expand All @@ -60,4 +60,4 @@ When no longer needed, delete the test user. If you don't know how to delete a M
## Next steps

> [!div class="nextstepaction"]
> [Integrate Microsoft Entra activity logs with Azure Monitor logs](howto-integrate-activity-logs-with-azure-monitor-logs.yml)
> [Analyze activity logs with Microsoft Graph](howto-analyze-activity-logs-with-microsoft-graph.md)
13 changes: 5 additions & 8 deletions docs/identity/saas-apps/greenhouse-tutorial.md
Original file line number Diff line number Diff line change
Expand Up @@ -78,21 +78,18 @@ Follow these steps to enable Microsoft Entra SSO.

![Edit Basic SAML Configuration](common/edit-urls.png)

1. On the **Basic SAML Configuration** section, if you wish to configure the application in **IDP** initiated mode, enter the values for the following fields:
> [!NOTE]
> [Greenhouse Client support team](https://www.greenhouse.io/contact) recommends configuring Entra ID side application settings for **IDP** initiated mode. Contact Greenshouse Client support team for more details and get the correct vales mentioned below.
1. On the **Basic SAML Configuration** section enter the values for the following fields:

a. In the **Identifier** text box, type the value:
`greenhouse.io`

b. In the **Reply URL** text box, type a URL using the following pattern:
`https://<COMPANYNAME>.greenhouse.io/<ENTITY ID>/users/saml/consume`

1. Click **Set additional URLs** and perform the following step if you wish to configure the application in **SP** initiated mode:

In the **Sign-on URL** text box, type the URL:
`https://app.greenhouse.io`

> [!NOTE]
> The value is not real. Update the value with the actual Reply URL. Contact [Greenhouse Client support team](https://www.greenhouse.io/contact) to get the value. You can also refer to the patterns shown in the **Basic SAML Configuration** section.
1. Leave the **Sign-on URL** text box empty.

4. On the **Set up Single Sign-On with SAML** page, in the **SAML Signing Certificate** section, click **Download** to download the **Federation Metadata XML** from the given options as per your requirement and save it on your computer.

Expand Down

0 comments on commit f6ff869

Please sign in to comment.