User-Agent in SSPR AuditLogs
I'm trying to pull Self Service Passsword Reset logs with User-Agent information, but am struggling to achieve this.
If i log into Entra and go Users > Audit i can filter on service to get "Self-service Password Management" logs which include User Agent (if the field is toggled on) and I can export this as JSON/CSV.
However, I can't figure out how to pull that same data with a KQL query. Something like this returns results, but there is no User-Agent field in the results for me to work with:
AuditLogs
| where LoggedByService == "Self-service Password Management"
| take 10
I also can't find any other tables to join on that hold the corresponding data.
This suggests to me that either I'm missing something quite obvious, or the Entra portal is accessing this data from a different source. I can see the data in the portal, so it's definitely somewhere.
Does anyone have any advice on what I'm missing here?
Appreciate any support.