Sign-In Logs

Monitor user sign-in activity across your Microsoft 365 environment. Track successful and failed authentications, detect suspicious sign-in patterns, and investigate potential account compromise.

Overview

The Sign-In Logs report provides detailed records of all authentication events in your managed Entra ID tenants. Use this data to monitor access patterns, investigate security incidents, and ensure compliance with access policies.

Log Columns

Column	Description
Date/Time	When the sign-in occurred
User	User principal name and display name
Application	Application the user signed into
Status	Success, Failure, or Interrupted
IP Address	Source IP of the sign-in attempt
Location	Geographic location based on IP
Device	Device name and operating system
Browser	Browser used for the sign-in
MFA Status	Whether MFA was required and satisfied
Conditional Access	Which CA policies were applied
Risk Level	None, Low, Medium, High

The report provides several analytical views:

Success vs. Failure rate — Track authentication success rates over time
Geographic distribution — Map of sign-in locations
Failed sign-in patterns — Identify brute force or password spray attacks
Application access — Which apps users are signing into
Device and browser trends — Track client platform usage

Suspicious Activity Indicators

Warning: The following patterns may indicate account compromise or attack activity:

Multiple failed sign-ins from different locations
Successful sign-in from an unusual location
Sign-in from a known malicious IP address
Impossible travel (sign-ins from distant locations in short time)
Sign-in from an anonymous or Tor network

Filters

Date Range — Last 24 hours, 7 days, 30 days, or custom
User — Filter by specific user or group
Status — Success, Failure, Interrupted
Application — Filter by target application
Risk Level — None, Low, Medium, High
Tenant — Filter by managed tenant

Graph API Data Sources

GET /auditLogs/signIns

API Reference

GET /api/monitoring/audit/sign-ins — Get sign-in logs
GET /api/monitoring/audit/sign-ins/summary — Get sign-in summary
POST /api/monitoring/audit/sign-ins/export — Export sign-in logs