Investigating a suspicious sign-in with Entra sign-in logs

4slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

solvingmicrosoft365.com

1 / 4

Investigating a suspicious sign-in with Entra sign-in logs

How to work a suspicious sign-in in the Entra sign-in logs: which log, which columns matter, traveller vs attacker, and when to escalate to compromise.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-sign-in-log-investigation-runbook

Slide 1Download PNG

solvingmicrosoft365.com

2 / 4

Which Entra sign-in log should I look at?

There are four: interactive user sign-ins (what a person did), non-interactive user sign-ins (token refreshes and background client activity), service principal sign-ins, and managed identity sign-ins. Attackers using a…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-sign-in-log-investigation-runbook

Slide 2Download PNG

solvingmicrosoft365.com

3 / 4

How can I tell a travelling user from an attacker in sign-in logs?

Look at device, client app, and token pattern, not just location. A traveller's sign-ins come from a known device ID with the usual apps; an attacker's typically come from an unmanaged device, a new user agent, a hostin…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-sign-in-log-investigation-runbook

Slide 3Download PNG

solvingmicrosoft365.com

4 / 4

How long are Entra sign-in logs kept?

Seven days in the free tier, 30 days with P1 or P2 in the portal. For anything longer, stream them to a Log Analytics workspace or Sentinel with diagnostic settings — an investigation of a compromise discovered six week…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-sign-in-log-investigation-runbook

Slide 4Download PNG

Auto-generated from Investigating a suspicious sign-in with Entra sign-in logs. This page is not indexed and isn't part of the guide itself.