Quickstart: Analyze sign-ins with the Azure AD sign-ins log

With the information in the Azure AD sign-ins log, you can figure out what happened if a sign-in of a user failed. This quickstart shows how to you can locate failed sign-in using the sign-ins log.


To complete the scenario in this quickstart, you need:

Perform a failed sign-in

The goal of this step is to create a record of a failed sign-in in the Azure AD sign-ins log.

To complete this step:

  1. Sign in to your Azure portal as Isabella Simonsen using an incorrect password.

  2. Wait for 5 minutes to ensure that you can find a record of the sign-in in the sign-ins log. For more information, see Activity reports.

Find the failed sign-in

This section provides you with the steps to analyze a failed sign-in:

  • Filter sign-ins: Remove all records that aren't relevant to your analysis. For example, set a filter to display only the records of a specific user.
  • Lookup additional error information: In addition to the information you can find in the sign-ins log, you can also look up the error using the sign-in error lookup tool. This tool might provide you with additional information for a sign-in error.

To review the failed sign-in:

  1. Navigate to the sign-ins log.

  2. To list only records for Isabella Simonsen:

    a. In the toolbar, select Add filters.

    Add user filter

    b. In the Pick a field list, select User, and then select Apply.

    c. In the Username textbox, type Isabella Simonsen, and then select Apply.

    d. In the toolbar, select Refresh.

  3. To analyze the issue, select Troubleshooting and support.

    Add filter

  4. Copy the Sign-in error code.

    Sign-in error code

  5. Paste the error code into the textbox of the sign-in error lookup tool, and then select Submit.

Review the outcome of the tool and determine whether it provides you with additional information.

Error code lookup tool

More tests

Now, that you know how to find an entry in the sign-in log by name, you should also try to find the record using the following filters:

  • Date - Try to find Isabella using a Start and an End.

    Date filter

  • Status - Try to find Isabella using Status: Failure.

    Status failure

Clean up resources

When no longer needed, delete the test user. If you don't know how to delete an Azure AD user, see Delete users from Azure AD.

Next steps