https://community.splunk.com/t5/Getting-Data-In/Azure-Authentication-Logs-Authentication-Method-Field-How-to/m-p/754536#M119781 <P>Did you find an answer to this?</P> Tue, 21 Oct 2025 17:14:52 GMT dansyring 2025-10-21T17:14:52Z https://community.splunk.com/t5/Getting-Data-In/Azure-Authentication-Logs-Authentication-Method-Field-How-to/m-p/598677#M104418 <P>In our Splunk environment, we currently ingest Azure AD logs and we have three different sourcetypes:</P> <P>azure:aad:signin<BR />azure:aad:audit</P> <P>azure:aad:user</P> <P>There no missing events and the ingested data is very rich. However, I don't see any way within the Splunk ingested Azure signin data to to filter by authentication method (Single-factor vs multi-factor). This is something that can be done via Azure Active Directory, Monitoring, Sign-in logs but I do not see any reference to it in my Splunk data (I do see a lot of conditional access enforcement and the other primary fields, but not any of the secondary fields that could be used for filtering in Azure):<BR /><BR /></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Dmikos1271_0-1653058959208.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19740i92F94661F5817D9E/image-size/medium?v=v2&amp;px=400" role="button" title="Dmikos1271_0-1653058959208.png" alt="Dmikos1271_0-1653058959208.png" /></span></P> <P>&nbsp;</P> Fri, 20 May 2022 15:55:23 GMT https://community.splunk.com/t5/Getting-Data-In/Azure-Authentication-Logs-Authentication-Method-Field-How-to/m-p/598677#M104418 Dmikos1271 2022-05-20T15:55:23Z https://community.splunk.com/t5/Getting-Data-In/Azure-Authentication-Logs-Authentication-Method-Field-How-to/m-p/754536#M119781 <P>Did you find an answer to this?</P> Tue, 21 Oct 2025 17:14:52 GMT https://community.splunk.com/t5/Getting-Data-In/Azure-Authentication-Logs-Authentication-Method-Field-How-to/m-p/754536#M119781 dansyring 2025-10-21T17:14:52Z