Up until recently, Azure AD sign-in logs were limited to interactive sign ins, however Microsoft recently added support for additional SignIn types including:

• NonInteractive
• ServicePrincipal
• ManagedIdentity

Related Elastic discuss issue: https://discuss.elastic.co/t/filebeat-azure-module-additional-azure-ad-log-sources/262026

In order to reduce AzureAD sign-in blindspots, this issue is aimed to track progress on support for these new signin types within our Azure module.

Relevant lines in ingest pipelines:

https://github.com/elastic/integrations/blob/1a817c4d9003a97c4a663e123fe6582a2f5fdf57/packages/azure/data_stream/auditlogs/elasticsearch/ingest_pipeline/default.yml#L21-L22

https://github.com/elastic/integrations/blob/1a817c4d9003a97c4a663e123fe6582a2f5fdf57/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml#L17-L18