How to read a Microsoft Entra Sign-In Like an Investigator

A Microsoft Entra sign-in log is more than a simple success or failure. In this episode, Alex and Maya examine how to read a sign-in event as an evidence trail, connecting identity, authentication, client and protocol, device, location, application, resource, Conditional Access, risk, status, error information, and correlation identifiers.

The discussion focuses on an evidence-first investigation approach: start with the exact sign-in event, understand what actually happened during authentication, identify the policies and requirements that applied, and connect the available evidence before reaching a conclusion. The episode also examines how the same sign-in data can be used proactively to identify patterns such as legacy authentication, repeated failures, Conditional Access anomalies, unusual device activity, and suspicious risk signals.

The central lesson is straightforward: don't just ask whether the sign-in succeeded. Ask what story the sign-in event tells you.

This episode is based on the Support Engineering Blog article “Microsoft Entra Sign-In Logs Explained: A Field Guide for Administrators and SOC Teams”, including its sign-in event model, investigation guidance, worked example, and supporting diagrams.

Chapters

00:00 - Read the Sign-In Differently

02:16 - Status, Errors, and Authentication

06:20 - Client, Device, and Location

08:40 - Application, Resource, and Policy

11:56 - Conditional Access and Session Controls

13:01 - Case Study: MFA Succeeded, Access Failed

15:24 - The Evidence-First Investigation

19:24 - From Troubleshooting to Threat Hunting

Learn more:

The full technical article, references and supporting resources are available through the Support Engineering Blog.