This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 80%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESG%3C/text%3E%3C/svg%3E)
We rely on our Sign-in logs to verify folks aren't signing in from unusual locations or at unusual times, but just noticed the logs seem to be woefully incomplete. For example, today nearly none of our sampled users are showing up in the logs, even though email has been accessed from their cell phones and Outlook desktop.
We are reviewing the Sign-in logs from under Azure AD - Compliance, and reviewing 'User sign-ins (interactive)', 'User sign-ins (non-interactive)', 'Service principal sign-ins', and 'Managed identity sign-ins'.
Am I missing something?
They should be in the in the non interactive
Set the date back 7 days and filter for the application "Office 365 Exchange Online" or "Outlook Mobile" etc...
Ah, I see where my understanding was off. Your reply prompted me to search for more information about non-interactive sign-ins and found this page https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins#non-interactive-user-sign-ins
Since these signins are token based it makes sense they would work the way they are, but unfortunately makes tracking a little more difficult from a security standpoint. I understand why now though at least, so thanks for your answer.