Microsoft Entra Id - Sign In Log API

Question

Hello Team,

We could see there are four types of Sign-in logs as per https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins?source=recommendations#what-are-the-types-of-sign-in-logs.

Is Sign-in API return all these type of logs ? Or do we have any other APIs to pull the different category sign-in logs? Could you please let us know.

Sign-in API reference : https://learn.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-1.0&tabs=http

Thanks,
Ravi P.

Answer 1

You can use the signin API, however via the /beta endpoint. You can find some examples therein as well: https://learn.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-beta&tabs=http#example-3-retrieve-the-first-10-sign-ins-where-the-signineventtype-isnt-interactiveuser-starting-with-the-latest-sign-in

Unfortunately, currently there seems to be an issue with the nonInteractiveUser category, but hopefully Microsoft will fix it in the coming days. You can still query other types:

GET https://graph.microsoft.com/beta/auditLogs/signins?&$filter=(signInEventTypes/any(t:t eq 'servicePrincipal'))&$top=10