Sign-in log details
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 804fbbf · +5 −4 lines · also on GitHub
⋯ 1 unchanged line
22
title: Learn about the sign-in log activity details
33
description: Learn about the information available on each of the tabs on the Microsoft Entra sign-in log activity details.
44
author: shlipsey3
5
−manager: femila
5
+manager: pmwongera
66
ms.service: entra-id
77
ms.topic: conceptual
88
ms.subservice: monitoring-health
9
−ms.date: 05/12/2025
9
+ms.date: 07/01/2025
1010
ms.author: sarahlipsey
1111
ms.reviewer: egreenberg14
1212
⋯ 147 unchanged lines
160160
161161
- **Multifactor authentication:** When a user signs in with MFA, several separate MFA events are actually taking place. For example, if a user enters the wrong validation code or doesn't respond in time, more MFA events are sent to reflect the latest status of the sign-in attempt. These sign-in events appear as one line item in the Microsoft Entra sign-in logs. That same sign-in event in Azure Monitor, however, appears as multiple line items. These events all have the same `correlationId`.
162162
163
−- **Authentication requirement:** Shows the highest level of authentication reached during the sign-in attempt, but not the highest level of authentication required.
164
− - For sign-in attempts where MFA is required but primary authentication failed, value is `singleFactorAuthentication` because the attempt wasn't evaluated by Conditional Access to require MFA.
163
+- **Authentication requirement:** Shows the authentication requirement requested by the resource provider for the sign-in to succeed. This value commonly reflects the authentication stage reached during the sign-in.
165164
- A subsequent sign-in attempt after the failure where primary authentication is successful and MFA is required, the value is `multiFactorAuthentication`.
165
+ - There are some edge cases where this field doesn't reflect the authentication reached during the sign-in. For example, if the requirement is already fulfilled from a previous MFA claim the resource provider doesn't ask to enforce it.
166
+ - For sign-in attempts where MFA is required but primary authentication failed, value is `singleFactorAuthentication` because the attempt wasn't evaluated by Conditional Access to require MFA.
166167
- Graph API supports `$filter` (`eq` and `startsWith` operators only).
167168
168169
- **Sign-in event types:** Indicates the category of the sign-in the event represents.
⋯ 21 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:36 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.