Cascade Authentication in Entra ID Sign in Logs

Question

Cascade Authentication in Entra ID Sign in Logs

Abdelrahman AL-Nahhas 20

We see Cascade Authentication in our Azure sign in logs as application, however our users when asked do not recognize this application. What is this referring to?

These are the Authentication Details

User's image

Accepted answer

1 additional answer

Your answer

Answer 1

Jyotishree Moharana 1,845 Microsoft External Staff Moderator

Hello @Abdelrahman AL-Nahhas,

Cascading authentication can happen when there are multiple Identity providers and especially seen in environments with federation in place or have Azure AD B2C configuration. Cascade authentication that you are seeing in the logs it isn't an application it is a type of authentication which can happen based on availability or the defined user flows.

The sign-ins could have been logged when trying to use any application or integration which may have triggered additional authentication.

Abdelrahman AL-Nahhas 20 Reputation points

2025-04-17T05:06:43.31+00:00

What might be the reason Microsoft show it as an application with an app id, and how can look for that application or integration or the other identity provider info?
Jyotishree Moharana 1,845 Reputation points Microsoft External Staff Moderator

2025-04-17T13:19:23.84+00:00

It is possible that it was created automatically as application in background. If it has an app ID, you can perform global search in your tenant and check for details like creation time. If you have the audit logs being uploaded to Defender or Sentinel or Azure monitor or any event hub, you can try looking for logs relating to that app ID.
Abdelrahman AL-Nahhas 20 Reputation points

2025-04-17T13:42:29.7666667+00:00

Although I cannot find anything in the tenant related to the app the idea of it being a background process makes the most sense.

Thanks a lot for the help

Answer 2

Vasil Michev 119.7K MVP Volunteer Moderator

It might be something built-in, as mentioned in this thread: https://learn.microsoft.com/en-us/answers/questions/2127397/azure-sign-in-logs-cascade-authentication

Do you see an AppID value? If so, you can cross-reference it via quick online search. Similarly, if you are using Defender for Cloud, look it up in their database.

Abdelrahman AL-Nahhas 20 Reputation points

2025-04-15T19:10:54.5366667+00:00

I copied the application ID and searched for it through the whole tenant (Entra ID Apps, KQL, and Defender for Cloud).

I've done a google search on the App id and nothing came out of it. only public sandbox reports with xml data that contain the App ID.

like you said I thought it's a process that lets the user can access multiple applications without needing to reauthenticate for each one similar to SSO, but could not find any evidence on that and what does it show up as an app with an app id

Share via

Cascade Authentication in Entra ID Sign in Logs

1 additional answer

Your answer