Sign-in logs question

Question

Hi,

I need to help to understand the sign logs in Microsft Entra admin center. I found some external user activity in sign logs. I am confused how can i know which service is accesiing. How can i verify it's only teams meeting or teams channel or Sharepoint site? Or is there anyway we can find whose internel user send request to that unknown users?

Thank You!

Irin Sultana

Answer 1

@Irin Sultana, the sign in logs will only show you information about user authentication, it won't show each site accessed by the user.

I'm not a Teams / SharePoint specialist, but I believe yo ucan use Purview to look for the SharePoint audit logs you want.

https://learn.microsoft.com/en-us/purview/audit-log-sharing?tabs=microsoft-purview-portal

Let me know if you have further questions.

Thanks,

Fabio

Answer 2

Hi @Irin Sultana, Thanks for reaching out to Microsoft Q&A!

Inside each sign in log event, you have the option to expand and check for the details about the sign in just like shown in the link below

https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-in-log-activity-details

If you do not recognize the guest user that is signing in to your applications, I strongly recommend you to block the user while you investigate it further.

Let me know if you have any more questions.

Thanks,

Fabio

Answer 3

Hi @Irin Sultana

I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.

Thanks,

Fabio

Answer 4

Hi @Irin Sultana

I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.

Thanks,

Fabio