On Microsoft Entra I am unable to see user name with unauthorized access how do I view the users?

Question

Hello

I see unauthorized sign-in on the Entra Microsoft account. I don't see the list of users that are having unprotected sign-in. How do I see it? I have all the privileges still I don't see the names of the users.

Answer 1

Hello Keerthi Mishra,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

Problem

I understand that you are unable to view the usernames of individuals who have unauthorized sign-ins within Microsoft Entra.

Solution

To solve the problem of viewing usernames with unauthorized access in Microsoft Entra (Azure Active Directory) I will provide two options, you can choose any that's convenient for your use and also you will need to follow the steps below:

Using Azure Portal

1. Access the Azure portal by sign-in.
2. Verify your permissions to ensure you have the necessary access rights. You might need to be a Global Administrator or have the Security Reader role. After ensuring that you have permission then, proceed to step three below.
3. Navigate to Azure Active Directory by Go to Sign-In Logs. In the Azure Active Directory blade, select "Monitoring" and then "Sign-ins." This will display a list of all sign-ins for your organization. Use the filter options at the top of the Sign-ins page.
4. Review detailed information to see usernames and failure reasons. Click on a specific sign-in entry to view more details. This includes the username, status, application used, and the reason for the failure (e.g., incorrect password, conditional access policy).
5. Enable and review additional reports like Risky Sign-Ins and Risky Users for comprehensive insights.
   1. Ensure that diagnostic settings are configured to log data to a storage account, Log Analytics workspace, or Event Hub for more granular insights.
   2. Navigate to "Security" under Azure Active Directory, then select "Risky sign-ins" to see a list of sign-ins flagged as risky by Azure AD Identity Protection.
   3. Similarly, you can view "Risky users" to see users who have been flagged for potential compromise.

Accept Answer

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful ** so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam

Answer 2

@Keerthi Mishra Adding to the above answer, please review this blog - https://techcommunity.microsoft.com/t5/microsoft-entra-blog/conditional-access-overview-and-templates-are-now-generally/ba-p/3888722 where you can use this filter helps to view all unprotected sign-ins users list.

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Answer 3

@Keerthi Mishra

Thank you for posting your query on Microsoft Q&A, from above description I could understand that you are looking for list of users who does not have CA policy applied to there account.

Please confirm if this is not the ask by responding the comments section.

To view the list of non-CA policy targeted users you may navigate to

Users > Signin Logs > Add Filter and choose Conditional Access > Not Applied:

Now select any of the event and look for username and user section under basic info:

If you don't have any further queries and the suggestion above answers your ask, please "Accept the answer", This will help us and others in the community as well.

Thanks,

Akshay Kaushik