Entra ID sign-in investigation cheat sheet
Review recent sign-ins and distinguish authentication from policy failures.
Microsoft Entra admin center sign-in logs. Labels can vary by portal release.
Updated · Entra ID · 7 min read
| Console path | What it does |
|---|---|
Entra ID → Monitoring & health → Sign-in logs | Open sign-in activity |
Filter by user, date and status | Isolate the reported attempt |
Open event → Basic info / Authentication details | Read the authentication outcome |
Open event → Conditional Access | Inspect applied policy results |
Walkthrough
Use at least an appropriate log-reading role such as Reports Reader. Available history and fields depend on licensing and retention.
Step 1: Open sign-in activity
Entra ID → Monitoring & health → Sign-in logs
Select the affected tenant first. Limit the time window and user so you do not mistake unrelated background sign-ins for the reported attempt.
Step 2: Isolate the reported attempt
Filter by user, date and status
Record the timestamp and time zone, application and correlation ID. Ask the user for the precise attempt time if multiple failures exist.
Step 3: Read the authentication outcome
Open event → Basic info / Authentication details
Compare the failure reason with individual authentication steps. A successful first factor may still be followed by an MFA or policy failure.
Step 4: Inspect applied policy results
Open event → Conditional Access
Inspect each evaluated policy and grant control. Report-only results do not enforce a block; do not disable policies as a diagnostic shortcut.