Hello Doug Greene,
I understand you're seeing non-interactive events in the interactive sign-in log, and I get how frustrating that can be especially since this wasn’t happening before.
There are some special considerations in how Microsoft categorizes sign-ins:
- Previously, certain non-interactive sign-ins (e.g., Exchange clients) were included in interactive logs because there wasn’t a separate category for them.
- Even after Microsoft introduced a non-interactive sign-in log, some authentication methods, like FIDO2 security keys, still appear in interactive logs due to how the system processes them.
- These sign-ins might seem interactive because they display browser details and credential type, even though they technically aren’t.
Since this started showing up for you recently, Microsoft likely made a change that now includes these events in the report. Unfortunately, sign-in logs are system-generated and can’t be changed or removed, so there’s no way to switch it back.
Microsoft has documented this behavior in their interactive sign-in logs article, explaining why some non-interactive events still show up in the interactive report. You can check that here:
This seems to be more of a reporting adjustment rather than something affecting security. I know unexpected changes like this can be frustrating but hope this helps clear things up!
Regarding Excessive logs:
Microsoft has recently started capturing sign-in events in more detail. What used to be a single sign-in entry may now appear as multiple—one for password authentication, another for MFA, and potentially more depending on the authentication flow. Clicking on each entry in the sign-in logs should provide more details on why these additional logs are showing up. It’s not necessarily an issue, just a change in how authentication events are recorded.
Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.