Entra ID Sign-in Logs

What are Entra ID Sign-in Logs?

Microsoft Entra ID Sign-in Logs record authentication attempts made by users and applications within a Microsoft Entra tenant. These logs provide detailed information about who signed in, when the sign-in occurred, which application was accessed, and whether the sign-in was successful or blocked.

Administrators use sign-in logs to monitor authentication activity and investigate potential security issues.

Examples of information captured in sign-in logs include:

• User sign-in attempts
• Application accessed during sign-in
• Sign-in status (success or failure)
• Client application used
• Device and location details

How to Use Entra ID Sign-in Logs

Administrators can view sign-in logs through the Microsoft Entra Admin Center or retrieve them using Microsoft Graph PowerShell.

Using the Microsoft Entra Admin Center

Follow these steps to view sign-in logs:

1. Open the Microsoft Entra Admin Center: https://entra.microsoft.com
2. Navigate to Entra ID → Monitoring & health → Sign-in logs
3. Use available filters to analyze activity by:
• User
• Application
• Sign-in status
• Date and time

The portal allows administrators to quickly investigate authentication events and identify suspicious activity.

Using Microsoft Graph PowerShell

Sign-in logs can also be retrieved using Microsoft Graph PowerShell.

Retrieve sign-in logs:

Get-MgAuditLogSignIn

Retrieve selected properties:

Get-MgAuditLogSignIn | Select Id, AppDisplayName, AppId, ClientAppUsed

PowerShell allows administrators to export data, automate monitoring, and build security reports based on sign-in activity.

Key Features of Entra ID Sign-in Logs

Delegated Permissions

Feature	Description
Authentication Tracking	Records all user sign-in attempts
Application Visibility	Shows which application was accessed
Sign-in Status	Indicates whether authentication succeeded or failed
Detailed Event Data	Includes client app, device, and location information
PowerShell Access	Allows automated retrieval of sign-in logs

Use Cases for Entra ID Sign-in Logs

Common use cases include:

• Investigating failed sign-in attempts
• Monitoring suspicious login activity
• Tracking application access by users
• Reviewing authentication activity for security audits
• Generating sign-in activity reports for administrators

Sign-in logs provide valuable insight into authentication activity and help organizations maintain secure access to Microsoft Entra resources.