Sign-in log details
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c7ca5f6 · +4 −2 lines · also on GitHub
⋯ 5 unchanged lines
66
ms.service: entra-id
77
ms.topic: conceptual
88
ms.subservice: monitoring-health
9
−ms.date: 02/25/2025
9
+ms.date: 05/12/2025
1010
ms.author: sarahlipsey
1111
ms.reviewer: egreenberg14
1212
⋯ 147 unchanged lines
160160
161161
- **Multifactor authentication:** When a user signs in with MFA, several separate MFA events are actually taking place. For example, if a user enters the wrong validation code or doesn't respond in time, more MFA events are sent to reflect the latest status of the sign-in attempt. These sign-in events appear as one line item in the Microsoft Entra sign-in logs. That same sign-in event in Azure Monitor, however, appears as multiple line items. These events all have the same `correlationId`.
162162
163
−- **Authentication requirement:** Shows the highest level of authentication needed through all the sign-in steps for the sign-in to succeed.
163
+- **Authentication requirement:** Shows the highest level of authentication reached during the sign-in attempt, but not the highest level of authentication required.
164
+ - For sign-in attempts where MFA is required but primary authentication failed, value is `singleFactorAuthentication` because the attempt wasn't evaluated by Conditional Access to require MFA.
165
+ - A subsequent sign-in attempt after the failure where primary authentication is successful and MFA is required, the value is `multiFactorAuthentication`.
164166
- Graph API supports `$filter` (`eq` and `startsWith` operators only).
165167
166168
- **Sign-in event types:** Indicates the category of the sign-in the event represents.
⋯ 21 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:36 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.