How to download and analyze the Microsoft Entra provisioning logs

The Microsoft Entra provisioning logs provide details about the provisioning events that occur in your tenant. You can use the information captured in the provisioning logs to help troubleshoot issues with a provisioned user.

This article describes the options for downloading the provisioning logs from the Microsoft Entra admin center and how to analyze the logs. Error codes and special considerations are also included.

Prerequisites

• A working Microsoft Entra tenant with a Microsoft Entra ID P1 or P2 license associated with it.
• Reports Reader is the least privileged role required to access the provisioning logs.
  • For a full list of roles, see Least privileged role by task.

How to view the provisioning logs

There are several ways to view or analyze the Provisioning logs:

• View in the Microsoft Entra admin center.
• Stream logs to Azure Monitor through diagnostic settings.
• Analyze logs through Workbook templates.
• Access logs programmatically through the Microsoft Graph API.
• Download the logs as a CSV or JSON file.

To access the logs in the Microsoft Entra admin center:

1. Sign in to the Microsoft Entra admin center as at least a Reports Reader.
2. Browse to Identity > Monitoring & health > Provisioning logs.

How to download the provisioning logs

To download the provisioning logs, select Download from the Provisioning logs page. Set the filters as specific as possible to reduce the size and time of the download.

CSV format

The CSV download includes three files:

• ProvisioningLogs: Downloads all the logs, except the provisioning steps and modified properties.
• ProvisioningLogs_ProvisioningSteps: Contains the provisioning steps and the change ID. You can use the change ID to join the event with the other two files.
• ProvisioningLogs_ModifiedProperties: Contains the attributes that were changed and the change ID. You can use the change ID to join the event with the other two files.

JSON format

To open the JSON file, use a text editor such as Microsoft Visual Studio Code. Visual Studio Code makes the file easier to read by providing syntax highlighting. You can also open the JSON file by using browsers in an uneditable format, such as Microsoft Edge.

Prettify the JSON file

The JSON file is downloaded in a format to reduce the size of the download. This format can make the payload hard to read. To prettify the file, there are two options:

• Use Visual Studio Code to format the JSON.

• Use PowerShell to format the JSON. This script produces a JSON output in a format that includes tabs and spaces:

  $JSONContent = Get-Content -Path "<PATH TO THE PROVISIONING LOGS FILE>" | ConvertFrom-JSON

  $JSONContent | ConvertTo-Json > <PATH TO OUTPUT THE JSON FILE>

Parse the JSON file

You can use any programming language that you're comfortable with. The following examples are in PowerShell.

• Read the JSON file:

  $JSONContent = Get-Content -Path "<PATH TO THE PROVISIONING LOGS FILE>" | ConvertFrom-JSON

Now you can parse the data according to your scenario. Here are a couple of examples:

• Output all job IDs in the JSON file:

  foreach ($provitem in $JSONContent) { $provitem.jobId }

• Output all change IDs for events where the action was "create":

  foreach ($provitem in $JSONContent) { if ($provItem.action -eq 'Create') { $provitem.changeId } }

What you should know

Here are some tips and considerations for analyzing the provisioning logs:

• The Microsoft Entra admin center stores reported provisioning data for 30 days if you have a premium edition and 7 days if you have a free edition. You can route the provisioning logs to Azure Monitor logs for retention beyond 30 days.

• You can use the change ID attribute as unique identifier, which can be helpful when you're interacting with product support, for example.

• You might see skipped events for users who aren't in scope.

  • Example 1: If the scope is set to all users and groups and setup scoping filters, you might see skipped logs for users that don't meet the scoping criteria.
  • Example 2: If the scope is set to assigned users and groups, you might continue to see users in the logs as skipped, even though they aren't assigned to the application. The way the provisioning service receives changes from the directory causes these users to appear.

• The provisioning logs don't show role imports (applies to Amazon Web Services, Salesforce, and Zendesk). You can find the logs for role imports in the audit logs.

Error codes

Use the following table to better understand how to resolve errors that you find in the provisioning logs.

Error codes for cross-tenant synchronization

Use the following table to better understand how to resolve errors that you find in the provisioning logs for cross-tenant synchronization.

Related content

• Check the status of user provisioning
• Problem configuring user provisioning to a Microsoft Entra Gallery application
• Graph API for provisioning logs