Quickstart: Access Microsoft Entra logs with the Microsoft Graph API

With the information in the Microsoft Entra sign-in logs, you can figure out what happened if a sign-in of a user failed. This quickstart shows you how to access the sign-in log using the Microsoft Graph API.


To complete the scenario in this quickstart, you need:

Perform a failed sign-in


Steps in this article may vary slightly based on the portal you start from.

The goal of this step is to create a record of a failed sign-in in the Microsoft Entra sign-in log.

  1. Sign in to the Microsoft Entra admin center as Isabella Simonsen using an incorrect password.

  2. Wait for 5 minutes to ensure that you can find a record of the sign-in in the sign-in log.

Find the failed sign-in

This section provides the steps to locate the failed sign-in attempt using the Microsoft Graph API.

Microsoft Graph Explorer query

  1. Navigate to Microsoft Graph Explorer.

  2. Follow the prompts to authenticate into your tenant.

    Microsoft Graph Explorer authentication

  3. In the HTTP verb drop-down list, select GET.

  4. In the API version drop-down list, select beta.

  5. In the Request query address bar, type https://graph.microsoft.com/beta/auditLogs/signIns?$top=100&$filter=userDisplayName eq 'Isabella Simonsen'

  6. Select Run query.

Review the outcome of your query.

Microsoft Graph Explorer response preview

Clean up resources

When no longer needed, delete the test user. If you don't know how to delete a Microsoft Entra user, see Delete users from Microsoft Entra ID.

Next steps