Sign-in log details
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 7262710 · +3 −3 lines · also on GitHub
⋯ 1 unchanged line
22
title: Learn about the sign-in log activity details
33
description: Learn about the information available on each of the tabs on the Microsoft Entra sign-in log activity details.
44
ms.topic: concept-article
5
−ms.date: 07/01/2025
5
+ms.date: 03/04/2026
66
ms.reviewer: egreenberg14
77
ms.custom: sfi-image-nochange
88
# Customer intent: As an IT admin, I want to understand the parts of a sign-in log so I can troubleshoot sign-in issues.
⋯ 176 unchanged lines
185185
186186
- **TimeGenerated and CreatedDateTime:**
187187
- If you're sending sign-in logs to a Log Analytics workspace, you might notice two different timestamps for the same sign-in event.
188
− - The `TimeGenerated` field in Log Analytics is the time the sign-in event was received and published by Log Analytics.
189
− - The `CreatedDateTime` field is the actual date and time of the sign-in event.
188
+ - The `TimeGenerated` field is the time when the sign‑in event record was ingested and stored in Log Analytics. It reflects when the log was processed and made available in the workspace.
189
+ - The `CreatedDateTime` field is the timestamp when the authentication event occurred and the sign‑in was processed by Microsoft Entra ID. It isn't the timestamp of the sign‑in event itself.
190190
- The difference between the two timestamps is caused by the time it takes for the sign-in event to be processed and sent to Log Analytics.
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:36 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.