‎how to verify user can login app with Entra ID‎

Question

we connected our application to let user authentication to login for using application with azure Entra ID or Microsoft Entra ID. So, how to verify or certify with log or status or anything else to shown that our user can be login to with Entra ID to use application with successful.

Answer 1

Hello @Winitr (MIS) Montewan,

To verify user authentication with Microsoft Entra ID in your application, you can follow these steps:

1. Authentication Testing: After integrating your application with Microsoft Entra ID, perform authentication testing by signing out completely and then signing in using a private browser session with your Microsoft Entra ID credentials. This will help confirm that the authentication process is functioning correctly.
2. Access Verification: Ensure that users can access your application at the designated URL (e.g., https://yourapplication.com) using their work credentials. This involves checking that the application correctly recognizes and grants access to users authenticated via Microsoft Entra ID.
3. Audit Logs: Review the audit logs in Microsoft Entra ID to monitor connection events and any authentication attempts. This can provide insights into successful and failed login attempts, helping you ensure that user access is being managed appropriately.
4. Single Sign-On (SSO) Functionality: Test the SSO functionality to ensure that users can sign in with their existing work credentials without needing to enter them multiple times across different applications.

---

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Answer 2

To verify that users can successfully sign in to an application using Microsoft Entra ID, use Microsoft Entra sign-in logs and, if needed, PowerShell-based reporting.

1. Enable and use sign-in logs
   • In the Microsoft Entra admin center, review the Sign-in logs for the tenant.
   • Filter by:
     • Application: select the enterprise app or service principal representing the application.
     • User: select the specific user (or leave unfiltered to see all users).
   • For each sign-in, check:
     • Status: should show success for a valid login.
     • Conditional Access / MFA details: if MFA is required, verify that the sign-in satisfied MFA.
   • These logs provide an auditable record that a user authenticated with Entra ID and obtained a token for the application.
2. Verify MFA registration and usage (if the app requires MFA)
   • If the application requires multifactor authentication, confirm that users are properly configured and that MFA is being enforced:
     • Use sign-in logs to see MFA-related failure reasons (for example, user doesn't have any verification methods registered, user entered incorrect code, etc.). These codes confirm whether MFA was attempted and why it failed.
   • To report on which users are registered for MFA, use Microsoft Graph PowerShell:
     • List users registered for MFA:

              Get-MgUser -All | Where-Object {$_.StrongAuthenticationMethods -ne $null -and $_.BlockCredential -eq $False} | Select-Object -Property UserPrincipalName
       

     • List users not registered for MFA:

              Get-MgUser -All | Where-Object {$_.StrongAuthenticationMethods.Count -eq 0 -and $_.BlockCredential -eq $False} | Select-Object -Property UserPrincipalName
       

     • Export MFA status and methods for audit/reporting:

              Get-MgUser -All |
                Select-Object 
                  @{N='UserPrincipalName';E={$_.UserPrincipalName}},
                  @{N='MFA Status';E={if ($_.StrongAuthenticationRequirements.State){$_.StrongAuthenticationRequirements.State} else {"Disabled"}}},
                  @{N='MFA Methods';E={$_.StrongAuthenticationMethods.methodtype}} |
                Export-Csv -Path c:\MFA_Report.csv -NoTypeInformation
       

   • These reports demonstrate which users are technically capable of completing MFA when your app or Conditional Access policy requires it.
3. Confirm authentication configuration for the app
   • Ensure the application is correctly integrated with Microsoft Entra ID and using the proper endpoints for user authentication, for example:
     • https://login.microsoftonline.com/{tenant}/v2.0 for single-tenant scenarios.
     • https://login.microsoftonline.com/common/v2.0 or https://login.microsoftonline.com/organizations/v2.0 for multitenant scenarios.
   • After a user signs in, validate the token claims (such as iss and tid) in the application to confirm that the user authenticated against the expected tenant.

By combining:

• Successful entries in Microsoft Entra sign-in logs for the application,
• Optional MFA registration and usage reports via PowerShell, and
• Token claim validation in the application, there is clear, auditable evidence that users can log in to the application with Microsoft Entra ID successfully.

---

References:

• Use the sign-in logs to review Microsoft Entra multifactor authentication events
• Authenticate applications and users with Microsoft Entra ID