Simple definition
Microsoft Entra sign-in logs record authentication attempts and their outcomes.
Technical definition
They expose information such as identity, application, IP address, device context, authentication method, result, and Conditional Access evaluation for supported sign-in types.
What is it used for?
Troubleshoot denied access, investigate suspicious authentication, and understand why an access policy was applied.
Practical example
An administrator can determine that a sign-in failed because a Conditional Access policy required a condition that was not met.
Common issues
- Reading only the error code without reviewing authentication details
- Investigating the wrong time range or sign-in type
- Interpreting an IP address or location without accounting for a proxy or VPN
How it works / role
For each supported attempt, Entra evaluates the identity and sign-in context and records the relevant steps and result. The logs can then correlate the user, application, Conditional Access controls, and authentication details to reconstruct the decision path.
Related terms
Key takeaway: Exact behavior can vary by version, product, and architecture; always validate on the environment actually deployed.