Sign-in Logs

You do not need every sign-in log field for every investigation. Start with the question, choose the fields that can answer it, and follow the evidence.

Learn how to read Microsoft Entra sign-in logs as an evidence trail—who signed in, how, where, what they accessed, why policy acted, and what happened.