Sign-in Log

The Entra ID sign-in log records every authentication attempt against the tenant — successful sign-ins, failed attempts, MFA challenges, Conditional Access policy evaluations, risk assessments. Each entry includes the user, app, IP address, location, device, client, authentication method, applied CA policies, and outcome. Searchable in the Entra admin center, exportable to Log Analytics / Microsoft Sentinel, and queryable via the Microsoft Graph. Retention varies by tier: 7 days on the free tier, 30 days on P1 / P2, longer with Log Analytics workspace storage. The primary surface for investigating user-impacting authentication issues and for identity-side threat hunting.

Worked example

A user reports they suddenly can't sign into Teams from home, though the office worked fine yesterday. Filtering the sign-in log to that user's account shows a string of failed attempts, each one denied by a Conditional Access policy requiring a compliant device — the user's home laptop was never enrolled in Intune, so it fails the same policy that let their office desktop through without issue. The log entry names the exact policy that blocked the sign-in, turning a vague "it doesn't work at home" ticket into a specific, actionable finding within a couple of minutes.

Common pitfalls

Confusing the sign-in log with the Purview audit log is one of the most common cross-portal mix-ups — the sign-in log is Entra ID's record of authentication events specifically (who tried to log in, from where, and whether Conditional Access allowed it), while the audit log tracks broader administrative and content actions across the platform; a "who deleted this file" question belongs in the audit log, not here. Relying on the free tier's short retention window for anything beyond immediate troubleshooting is a planning gap — without P1/P2 or a Log Analytics workspace, older sign-in history simply isn't retrievable when an investigation needs to look back further than a few days. And skimming past the "risk" and "applied Conditional Access policies" columns while only checking success/failure misses the columns that actually explain why a sign-in was allowed or blocked, which is usually the real question being asked.