liveBook · Manning

Interactive user sign-in

As explained in Azure Security

A sign-in event in which a user interactively provides credentials to access an Azure environment or resource.

An interactive user sign-in occurs when a user enters credentials or completes an authentication challenge, such as multifactor authentication, to access Azure resources. Microsoft Entra ID records the event for identity-access investigation. section 9.1.1

Review an interactive sign-in in the Azure portal:

  • Open Microsoft Entra ID and select Sign-In Logs. section 9.1.1
  • Filter by date and user, then open the relevant result. section 9.1.1
  • Use Basic Info for event details, Location for the originating IP address and location, and Conditional Access for the applied policy. section 9.1.1
Table 9.2 Categorization of different sign-in types in Microsoft Entra ID sign-in logs (view table figure)

Interactive user sign-ins

Noninteractive user sign-ins

Service principalsign-ins

Managed identity sign-ins

Where a user signs in with an authentication factor, such as a password or multifactor authentication challenge

Where a client signs in on behalf of a user and the user isn’t required to enter credentials

Where an application or service principal signs in without any user involvement

Where Azure services sign in and have secrets managed by Azure

Compare interactive user sign-ins with noninteractive user, service principal, and managed identity sign-ins. section 9.1.1

Investigating Bob’s sign-in

After Bob enters his credentials, filter the sign-in logs for Bob, inspect the event location, and verify whether the Conditional Access policy applies. section 9.1.1

How Azure Security covers it

How deep it goes
Explains the event category and provides a portal investigation workflow, without detailing authentication internals.
Examples
Uses Bob’s credential entry, sign-in location, originating IP address, and Conditional Access result.
What it assumes
Assumes Azure portal access and a Reader role such as Security Reader or Reports Reader.
What you can do after
Diagnose/debug with Microsoft Entra ID sign-in logs by locating a user event and checking its location and policy result.
How it connects
Connects Microsoft Entra ID sign-in logs with Conditional Access policies, authentication factors, and audit logs.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.