Sign-in log details

This page's changes and edits · All guidance changes

Microsoft's edit · 30 Jun 2025 19:45 UTC

logs-timereceived-063025

Microsoft's commit message in MicrosoftDocs/entra-docs · commit d033204 · +9 −4 lines · also on GitHub

⋯ 5 unchanged lines

66 ms.service: entra-id

77 ms.topic: conceptual

88 ms.subservice: monitoring-health

9 −ms.date: 02/25/2025

9 +ms.date: 06/30/2025

1010 ms.author: sarahlipsey

1111 ms.reviewer: egreenberg14

1212 ms.custom: sfi-image-nochange

⋯ 101 unchanged lines

114114 - **Success:** The Conditional Access policy was applied successfully to the sign-in attempt.

115115 - **Failure:** The Conditional Access policy was applied to the sign-in attempt, but the sign-in attempt failed.

116116 - **Not Applied:** The sign-in didn't match the criteria for the policy to be applied.

117 − - There are specific scenarios that due to their nature, are required to be exempt from Conditional Access evaluation to prevent a circular dependency (chicken-and-egg scenario) that would not be possible to complete. These are considered "bootstrap scenarios" and might include sign-ins associated with device registration, device compliance, or Network Policy Server connectors.

117 + - There are specific scenarios that due to their nature, are required to be exempt from Conditional Access evaluation to prevent a circular dependency (chicken-and-egg scenario) that wouldn't be possible to complete. These scenarios are considered "bootstrap scenarios" and might include sign-ins associated with device registration, device compliance, or Network Policy Server connectors.

118118 - Windows Hello for Business sign-ins show as "Not Applied" because Conditional Access policies protect sign-in attempts to cloud resources, not the Windows sign-in process.

119119 - **Disabled:** The policy was disabled at the time of the sign-in attempt.

120120

⋯ 15 unchanged lines

136136 - `Not applied`: No policy applied to the user and application during sign-in. Windows Hello for Business shows up as "Not Applied" because Conditional Access policies protect sign-in attempts to cloud resources, not the Windows sign-in process. Other sign-ins might get interrupted so a policy isn't applied.

137137 - `Success`: One or more Conditional Access policies applied to or were evaluated for the user and application (but not necessarily the other conditions) during sign-in. Even though a Conditional Access policy might not apply, if it was evaluated, the Conditional Access status shows *Success*.

138138 - `Failure`: The sign-in satisfied the user and application condition of at least one Conditional Access policy and grant controls are either not satisfied or set to block access.

139 − - Conditional Access does not apply to Windows sign-in, such as Windows Hello for Business. Conditional Access protects sign-in attempts to cloud resources, not the device sign-in process.

139 + - Conditional Access doesn't apply to Windows sign-in, such as Windows Hello for Business. Conditional Access protects sign-in attempts to cloud resources, not the device sign-in process.

140140

141141 - **Continuous access evaluation:** Shows whether continuous access evaluation (CAE) was applied to the sign-in event.

142142 - There are multiple sign-in requests for each authentication, which can appear on either the interactive or non-interactive tabs.

⋯ 6 unchanged lines

149149 - `b2bDirectConnect` - A cross tenant sign-in performed by a B2B.

150150 - `microsoftSupport`- A cross tenant sign-in performed by a Microsoft support agent in a Microsoft external tenant.

151151 - `serviceProvider` - A cross-tenant sign-in performed by a Cloud Service Provider (CSP) or similar admin on behalf of that CSP's customer in a tenant.

152 − - `unknownFutureValue` - A sentinel value used by MS Graph to help clients handle changes in enum lists. For more information, see [Best practices for working with Microsoft Graph](/graph/best-practices-concept).

152 + - `unknownFutureValue` - A value used by MS Graph to help clients handle changes in enum lists. For more information, see [Best practices for working with Microsoft Graph](/graph/best-practices-concept).

153153

154154 - **Tenant:** The sign-in log tracks two tenant identifiers that are relevant in cross-tenant scenarios:

155155 - **Home tenant** – The tenant that owns the user identity. Microsoft Entra ID tracks the ID and name.

⋯ 28 unchanged lines

184184 - If you're unsure of a detail in the logs, gather the **Request ID** and **Correlation ID** to use for further analyzing or troubleshooting.

185185 - If Conditional Access policies for authentication or session lifetime are applied, they're listed above the sign-in attempts. If you don't see either of those options, those policies aren't currently applied. For more information, see [Conditional Access session controls](~/identity/conditional-access/concept-conditional-access-session.md).

186186

187 +- **TimeGenerated and CreatedDateTime:**

188 + - If you're sending sign-in logs to a Log Analytics workspace, you might notice two different timestamps for the same sign-in event.

189 + - The `TimeGenerated` field in Log Analytics is the time the sign-in event was received and published by Log Analytics.

190 + - The `CreatedDateTime` field is the actual date and time of the sign-in event.

191 + - The difference between the two timestamps is caused by the time it takes for the sign-in event to be processed and sent to Log Analytics.

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:36 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.