Microsoft Entra ID sign-in logs record how identities access resources and applications. They complement audit logs: audit logs show tenant tasks, while sign-in logs help identify who performed them. section 9.1.1
Use the dataset to distinguish sign-in activity by identity and authentication context:
- Interactive user sign-ins record users entering credentials or completing an authentication challenge, such as multifactor authentication. section 9.1.1
- Noninteractive user sign-ins record clients acting for users without requiring them to enter credentials. section 9.1.1
- Service principal sign-ins record applications or service principals signing in without user involvement. section 9.1.1
- Managed identity sign-ins record Azure services authenticating with secrets managed by Azure. section 9.1.1
Investigating a conditional access decision
When Bob signs in with credentials, inspect the interactive user sign-ins to determine his sign-in location and whether the conditional access policy applied to his identity. Access requires an appropriate Reader role, such as Security Reader or Reports Reader. section 9.1.1
Table 9.2 Categorization of different sign-in types in Microsoft Entra ID sign-in logs (view table figure)
Browse the sign-in categories and their distinguishing authentication behaviors. section 9.1.1
