How to investigate the sign-ins to applications using SAML authentication

Microsoft Entra Health monitoring provides a set of tenant-level health metrics you can monitor to help improve the health of your tenant. The Security Assertion Markup Language (SAML) authentication scenario monitors SAML 2.0 authentication attempts that the Microsoft Entra cloud service for your tenant successfully processed.

• Learn how the Microsoft Identity platform uses the SAML protocol
• Use a SAML 2.0 IdP for single sign on.
• This metric currently excludes WS-FED/SAML 1.1 apps integrated with Microsoft Entra ID.
• Alerts are not available for this scenario.

Prerequisites

There are different roles, permissions, and license requirements to view health monitoring signals and configure and receive alerts. We recommend using a role with least privilege access to align with the Zero Trust guidance.

• A tenant with a Microsoft Entra P1 or P2 license is required to view the Microsoft Entra health scenario monitoring signals.
• The Reports Reader role is the least privileged role required to view scenario monitoring signals.
• The HealthMonitoringAlert.Read.All permission is required to view the alerts using the Microsoft Graph API.
• For a full list of roles, see Least privileged role by task.

Investigate the signals

You can view the signal using the Microsoft Entra admin center and the Microsoft Graph API. For more information, see How to investigate health scenario alerts for guidance on how to gather data using the Microsoft Graph API.

1. Sign into the Microsoft Entra admin center as at least a Reports Reader.

2. Browse to Entra ID > Monitoring & health > Health. The page opens to the Service Level Agreement (SLA) Attainment page.

3. Select the Health Monitoring tab.

4. Select the Sign-ins to applications using SAML authentication scenario.