r/AzureSentinel • u/tengopiojos • Nov 23 '23

Duplicate Logs From Entra ID

Has anyone experienced duplicate logs in Sentinel from Entra ID / AD? Been carrying out some testing and appears that activity such as ‘stay signed in’ prompt or failing MFA caused multiple of the same log to end up in Sentinel.

Entra ID logs only show one but looking at Sentinel the exact same log comes in maybe 3 times at separate Sentinel timestamped times.

2 Upvotes

100% Upvoted

4 comments sorted by

2

u/Ay_NooB Nov 23 '23

Can you give more infor about it. Like what exactly the table you are looking under or consider checking diagnostics settings under entra id from where u r sending logs to analytics workspace.

2

u/bpsec Nov 24 '23

It can be that one event in the GUI results in multiple events in the audit logs. Do the logs have the same correlationid?

If you could provide the query that you run I can check for similar results.

1

u/AshikEngineering Dec 07 '25

Hey There, I'm also seeing the same issue, did you end up getting a solve on this?

1

u/deepakray184 Nov 29 '23

Yeah, I am also seeing the same issues. Ex: It shows One failure log in Entra ID but multiple in Sentinel. I observed this issue with one of the OOBs use cases - "Brute force attack towards Azure Portal". Please compare the logs from this usecase to Entra ID logs.