How to read the sign in log

Question

I am not sure how to read the sign in log. I have had an employee that can't figure out how to log into her email but just received an email from her even though the sign in log says she hasn't signed in for the past 7 days. Does it discount phones or tablets? Only PC sign ins? What is it logging?

Answer 1

Dear @Annette Coffee,

As a moderator, I do not have the tools to investigate your specific account directly because this is a user-to-user support forum. Our role is limited to providing technical support on reported issues, requests, or ideas. However, I will try my best to clarify you as clearly as possible.

Based on your questions:

What does the Entra sign-in log actually “log”?

Microsoft Entra logs all sign-ins into your Entra tenant (apps/resources that use Entra ID for authentication).

Each sign-in event is best interpreted as:

• Who signed in (the user identity)
• How they signed in (the client/application used)
• What they accessed (the target resource/app)

It also captures details that help troubleshooting, such as whether the attempt succeeded/failed and the context of the attempt (for example, you can analyze patterns like sign-ins by browser or operating system). Sign-in logs in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

To read all users sign-in logs, please go to Microsoft Entra admin center > Monitoring & health > Sign-in logs

If you want to read a specific user's sign-in logs, go to Microsoft Entra admin center > Users > choose a specific user > Sign-in logs

Does it “discount” phones/tablets? Or only PC sign-ins?

Entra sign-in logs are not “PC-only.” The logs are meant to help answer questions like whether users are signing in from certain browsers or operating systems, which implies device/platform context is part of what the logs track.

Also, Entra separates sign-ins into different categories, including:

• Interactive sign-ins
• Non-interactive sign-ins
• Application sign-ins
• Managed identity

So if you only looked at one view (commonly Interactive sign-ins), you can miss activity that lands under Non-interactive sign-ins (background/token-based activity). Sign-in logs in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

In addition here is "Why user can send email even when no sign-in appears":

A user can send an email in ways that may not line up with what you’re filtering/looking at in sign-in logs (for example, cached sessions, background token refreshes, or activity categorized differently). Entra sign-in logs are about the sign-in request and its outcome (classified as Non-interactive sign-ins/ use token-based auth)

I hope this full-fill your request, if it does not, please share more detailed information which I could help you efficiently.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Microsoft Entra sign-in logs record all authentications to resources that use Microsoft Entra ID (Azure AD) for sign-in, not just PC logons. They include:

• Browser sign-ins (for example, Outlook on the web)
• Mobile and tablet app sign-ins (for example, Outlook mobile)
• Other client apps and services that authenticate against Microsoft Entra ID

What the sign-in log is logging:

• Who: The identity signing in (user, username, user ID, sign-in identifier, user type).
• How: The client and method used (authentication requirement, client app, client credential type, Continuous Access Evaluation).
• What: The resource being accessed (application, application ID, resource, resource ID, resource tenant ID, resource service principal ID).
• Unique identifiers: Correlation ID, request ID, and unique token identifier for the token used.

These entries are system-generated and can’t be changed or deleted.

Why email might appear without recent sign-ins in the log:

• The user may be using an existing authenticated session or token on a device (PC, phone, or tablet) that hasn’t needed to reauthenticate in the last 7 days. In that case, the last interactive sign-in could be older than 7 days, but the mail client can still send/receive using valid tokens.
• The user might be sending from a different account or shared mailbox than the one being checked in the sign-in logs.

How to investigate:

1. In the Azure portal, go to Microsoft Entra ID → Users → select the employee → Sign-in logs.
2. Expand the date range beyond 7 days and check both Interactive and Non-interactive sign-ins.
3. For a specific sign-in, open the details and review:
   • Basic info for who/how/what and any error codes.
   • Location and Device info to see if the sign-in came from a phone, tablet, or PC.
   • Authentication Details to see which methods and policies were applied.

This will show whether the account has been signing in from mobile devices or reusing existing sessions, even if the user reports trouble logging in now.

---

References:

• What are Microsoft Entra sign-in logs?
• Learn about the sign-in log activity details
• Learn about the sign-in log activity details – Sign-in activity components
• Learn about the sign-in log activity details – Sign-in activity details
• Troubleshoot Azure Sign-in Logs for Surface Hub – What are Azure sign-in logs?
• Troubleshoot Azure Sign-in Logs for Surface Hub – Analyze sign-in logs
• How to troubleshoot Microsoft Entra sign-in errors