Fix Get-AzureADAuditSignInLogs Missing User Agent Details
Question details
The user is attempting to extract the User Agent value for Exchange ActiveSync sign-ins using the Get-AzureADAuditSignInLogs cmdlet, but the data is missing from the output.
- Product
- Microsoft Azure AD
- Device & OS
- not provided
- Scenario
- Auditing sign-in logs via PowerShell to track device details and User Agent information for Exchange ActiveSync.
- Observed behavior
- The Microsoft 365 admin center successfully displays the User Agent value, but the Get-AzureADAuditSignInLogs PowerShell cmdlet returns device details without the User Agent field.
Ensure you have the appropriate Administrator permissions in Microsoft Entra ID to view complete sign-in logs and reports.
Use Microsoft Entra Admin Center Sign-in Logs
Since the PowerShell cmdlet does not expose the User Agent field, use the official web interface to view detailed sign-in reports.
The Get-AzureADAuditSignInLogs cmdlet is known to omit certain properties like the User Agent. The most reliable way to access this specific data is by utilizing the visual logs provided in the Microsoft Entra admin center.
Navigate to the Microsoft Entra admin center and sign in with your Global Administrator or Security Administrator credentials.
On the left navigation pane, expand 'Identity', go to 'Monitoring & health', and click on 'Sign-in logs'.
Use the filtering options to find the specific Exchange ActiveSync sign-in event you are auditing, then click on the log entry.
In the details panel that opens, click the 'Device info' tab to clearly see the 'User Agent' string associated with the sign-in.
Query Sign-in Logs Using Microsoft Graph API
Extract comprehensive sign-in properties, including the User Agent, by querying the Microsoft Graph API directly.
Document Your Audit Findings Easily with WPS Office
If you are exporting sign-in logs to CSV or drafting security audit reports, you don't need a pricey Microsoft Office subscription. WPS Office provides a free, powerful, and lightweight alternative that handles your spreadsheets and documents flawlessly.
- 1. Download the Installer: Visit the official WPS Office website and download the free version for your operating system.
- 2. Install the Software: Run the installer and follow the on-screen instructions to set up WPS Office on your computer.
- 3. Analyze Your Logs: Open your exported Azure AD sign-in CSV files using WPS Spreadsheets to filter, sort, and format your audit data instantly.
Frequently Asked Questions
Why is the User Agent field missing in Get-AzureADAuditSignInLogs?
The Get-AzureADAuditSignInLogs cmdlet belongs to the legacy Azure AD PowerShell module, which does not expose all properties available in the backend logs. The User Agent was intentionally excluded from this specific cmdlet's output.
Can I see the User Agent for Exchange ActiveSync in the admin center?
Yes. While PowerShell might omit it, both the Microsoft 365 admin center and the Microsoft Entra admin center sign-in logs correctly record and display the User Agent for Exchange ActiveSync.
Is there a newer PowerShell cmdlet that shows the User Agent?
You can transition to the Microsoft Graph PowerShell SDK and use the Get-MgAuditLogSignIn cmdlet, which aligns closely with the Microsoft Graph API and provides richer logging details than the legacy Azure AD cmdlets.
