Successful Entra ID UserType 4 Login Meaning

Question

What does it mean for a successful UserType 4 login? I understand that it was triggered by a server-side logic but what exactly does that mean? Would it be a cause of concern for a successful UserType 4 login from a foreign IP? |System|An audit event triggered by server-side logic. For example, Windows services or background processes.| | -------- | -------- | |System|An audit event triggered by server-side logic. For example, Windows services or background processes.|

Answer 1

It's nothing to worry about and you can safely ignore it. Microsoft is simply exposing such events as part of their transparency efforts, though they don't usually reveal all the details.