You do not need every sign-in log field for every investigation. Start with the question, choose the fields that can answer it, and follow the evidence.
Microsoft Entra
5 articles
MFA success does not guarantee access. Learn how to investigate authentication strength, grant controls, device compliance, and other Conditional Access requirements.
A practical guide to understanding Conditional Access evaluation—from policy applicability and requirements to the final access and session outcome.
Learn how to read Microsoft Entra sign-in logs as an evidence trail—who signed in, how, where, what they accessed, why policy acted, and what happened.
Don't change Conditional Access because a user is blocked. Find the sign-in event, understand the policy evaluation, identify the unmet requirement, and fix the cause.