How to Audit Sign-In Logs in Entra ID
Entra ID sign-in logs record every authentication attempt across your tenant. Knowing how to read and filter these logs is essential for investigating account compromises, diagnosing MFA issues, and understanding how Conditional Access policies are being applied.
Where to find sign-in logs
Logs are retained for 30 days for Entra ID P1/P2 and 7 days for free. Stream to Log Analytics for longer retention.
Log types
Filtering effectively
Key columns to read
- Status - Success/Failure and the failure reason code (e.g. 50126 = bad password)
- IP address - Where the sign-in came from
- Conditional Access - Which CA policies applied and whether they passed
- Client app - What client was used - legacy auth shows here
- MFA result - Whether MFA was required and whether it passed
Investigating suspicious sign-ins
- Filter sign-in logs to that user in the relevant timeframe
- Look for successful sign-ins from unexpected IPs or countries
- Check whether MFA was completed
- Check the CA policy column
- Look for impossible travel
- Check Entra ID Identity Protection → Risky users
Exporting logs
Stream to a Log Analytics workspace for Sentinel integration, or to Storage for long-term archival.
Frequently Asked Questions
30 days for P1/P2, 7 days for free. Configure Diagnostic Settings to stream to Log Analytics for longer retention.
Filter Status to Failed and look for error code 50074 (MFA required, not completed) or 50076 (MFA required by CA policy).
Interrupted means the sign-in started but was not completed - MFA was required but the user closed the browser, or a CA policy redirected to terms of use.