How to Export and Review Microsoft Entra ID Sign-In Logs
Summary
A practical guide to exporting Entra ID sign-in logs through the admin center or Microsoft Graph, accounting for retention limits, and spotting patterns such as password spraying and MFA fatigue.
Key points
- Sign-in logs can be downloaded as JSON in the Entra admin center or retrieved through Microsoft Graph.
- The article states that sign-in log retention is 7 days for Entra ID Free and 30 days for P1 or P2; older logs may be available in configured Log Analytics, Sentinel, or storage destinations.
- Reports Reader is identified as the least-privileged role for reading sign-in logs; Graph access also requires the appropriate permission, role, and license.
- Interactive, non-interactive, service principal, and managed identity sign-ins are recorded separately; the article notes that token replay and refresh-token abuse may appear under non-interactive sign-ins.
- Repeated 50126 errors across accounts can indicate password spraying, while bursts of 500121 errors can indicate MFA fatigue; a sequence of failures followed by a success from one IP range is highlighted as suspicious.
- The guide notes that the Graph v1.0 endpoint returns interactive sign-ins, while other sign-in types require the beta endpoint with a signInEventTypes filter.
Article Details
- Defense Focus
- Export and analyze Microsoft Entra ID sign-in logs to identify suspicious authentication activity before the logs expire.
- Detection Methods
- Look for many status.errorCode 50126 failures across multiple accounts, especially when followed by a successful sign-in from the same IP range.
- Investigate bursts of status.errorCode 500121 events as possible MFA fatigue activity.
- Review clientAppUsed values such as IMAP, POP, SMTP, and “Other clients” for legacy authentication that may bypass MFA.
- Assess conditionalAccessStatus, riskLevelDuringSignIn, location, and ipAddress for failed or unexpected access.
- Data Sources
- Interactive and non-interactive user sign-in logs
- Service principal and managed identity sign-in logs
- Sign-in log fields: status.errorCode, clientAppUsed, conditionalAccessStatus, riskLevelDuringSignIn, location, and ipAddress
- Microsoft Sentinel SigninLogs and AADNonInteractiveUserSignInLogs tables
- Directory audit logs for changes such as new users, role assignments, and app consents
- Defensive Actions
- Export sign-in logs while they remain within the tenant’s retention period: the article states 7 days for Entra ID Free and 30 days for P1 or P2.
- For older logs, check diagnostic-settings destinations such as Log Analytics, Microsoft Sentinel, or a storage account, if logging was configured there.
- Export each sign-in type separately where needed; use the beta Graph endpoint with a signInEventTypes filter for non-interactive and service principal sign-ins.
- For large date ranges, split portal exports by day or use Microsoft Graph paging.
- Check the reader role, AuditLog.Read.All consent, and tenant license when Graph access fails.
- During an incident, review directory audit logs in addition to sign-in logs.
- Review sanitized data before continuing with analysis.
MITRE ATT&CK
T1078.004 · Cloud AccountsThe article identifies detections for logins using stolen cloud credentials.T1110.003 · Password SprayingThe article identifies password-spraying detections in Prime Core and describes repeated 50126 failures across many accounts, potentially followed by a successful sign-in.T1621 · Multi-Factor Authentication Request GenerationThe article identifies MFA-fatigue detections and describes bursts of 500121 MFA failures or denials.
Vendors
Products
Log AnalyticsThe only place it might still exist is wherever your diagnostic settings send sign-in logs: a Log Analytics workspace, Microsoft Sentinel or a storage account.LogTotalUpload, sanitize and review in LogTotalMicrosoft GraphFor bigger or scripted pulls, use Microsoft Graph: GET /auditLogs/signIns.Microsoft SentinelThe only place it might still exist is wherever your diagnostic settings send sign-in logs: a Log Analytics workspace, Microsoft Sentinel or a storage account.Prime CorePrime Core has 170 detection rules for Entra ID sign-in data, mapped to 113 MITRE ATT&CK techniques.