Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Unable to download interactive sign-in logs
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 70%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESH%3C/text%3E%3C/svg%3E)
Steven Heicher
0
Reputation points
I'm trying to download the last month's sign-in logs within the Entra Admin Center. However, it waits about 10-12 minutes, and then it says it failed. Further, it says that it's being throttled.
Attached are the errors and what I'm trying to download. I've tried both CSV and JSON.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 67%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
Antony Maxwin 15 Reputation points2025-11-07T06:07:51.37+00:00 Hi @Steven Heicher
The error showing that you are trying to download the sign in logs but the size greater than the maximum where it supported , So better you try to export this to a storage account .Step from GPT for this .
Go to:
→ Microsoft Entra ID → Monitoring & health → Diagnostic settings
(or from Sign-in logs → click Export Data Settings)
Click + Add diagnostic setting.
Give it a name (e.g., SignInLogsToStorage).
Under Logs, tick Sign-in logs (and Audit logs if desired).
Under Destination details, select Archive to a storage account.
Choose the subscription and your Storage Account → Save.
✅ Result: Azure will start pushing JSON sign-in records automatically to your storage container (usually /insights-logs-signinlogs/resourceId=.../y=YYYY/m=MM/d=DD/h=HH/m=00/PT1H.json).
Please let me know if need any help i will simulate and give you more details
if it worked please mark the answer as helpful. or you can post how you resolved it. -
Steven Heicher 0 Reputation points
2025-11-07T14:26:30.72+00:00 @Antony Maxwin So I can tell you this. We average 90,000-97,000 records per month total... That includes every interactive sign-in in our tenant.
However, it's failing even when I narrow it down to 7 days and 24 hours of data. I don't think it's a record count. It's throttling even when I do a narrow period. I was able to get 24 hours, and I got 3482 records. Even if I were to take that number and multiply that by 30, it would be about 104k logins, but I can tell you, you would have Fridays weekends where login attempts would drop off.
Sign in to comment
Sign in to answer