Exercise - Set up and view sign-in logs and audit logs

  • 10 minutes

In this exercise, you view your Microsoft Entra sign-in logs, select columns and filter data for the logs, and then download the logs. You also view your Microsoft Entra instance audit logs through the Users menu.

In this exercise, you'll:

  • View sign-in logs for your Microsoft Entra instance.
  • Change columns to view in your sign-in logs.
  • Filter data to include in your sign-in logs view.
  • Download sign-in logs.
  • View audit logs through the Users menu.

Note

This exercise is optional. If you don't have an Azure account, you can read through the following instructions to understand how to use Log Analytics to view your sign-in and audit logs.

If you want to complete this exercise but you don't have an Azure subscription or prefer not to use your own account, you can create a free account before you begin.

View Microsoft Entra sign-in logs

To see the sign-in logs for Microsoft Entra ID:

  1. In the Azure portal, go to your Microsoft Entra instance.

  2. In the left menu under Monitoring, select Sign-in logs:

Screenshot that shows the default table columns in the sign-in logs.

Change columns to use in your sign-in logs view

Then, change the columns that appear for sign-in logs:

  1. In Sign-in logs in your Microsoft Entra instance, in the menu bar, select Columns.

    Screenshot that shows selecting the Columns option in the sign-in logs menu.

  2. In the Columns pane, for this exercise, select Operating system and Flagged for review to add those columns. Clear Resource ID to remove that column.

  3. Select Save.

Screenshot that shows selecting Save to select and clear columns for the sign-in logs.

Filter data in sign-in logs

Next, add filters for the data in your sign-in logs:

  1. In Sign-in logs in your Microsoft Entra instance, in the menu bar, select Add filters:

    Screenshot of the Add filters button in the sign-in logs menu.

  2. In the Pick a field dialog, select a filter, like Flagged for review, and then select Apply:

    Screenshot of the filter pick a field dialog.

  3. In the Flagged for review dialog, select Yes, and then select Apply.

Download the sign-in logs

Now, download the data in your view:

  1. In Sign-in logs in your Microsoft Entra instance, in the menu bar, select Download:

    Screenshot of the menu bar with the Download button selected.

  2. In the Download Sign-ins pane, select a format to use for the data: CSV or JSON. Enter a file name, and then select Download:

    Screenshot of the Download dialog details.

View audit logs by using the Users menu

To access audit logs through the Users menu in your Microsoft Entra instance:

  1. In the left menu under Manage, select Users:

    Screenshot of the Users menu.

  2. In the Users menu under Activity, select Audit logs:

    Screenshot of the Audit logs in the Users menu.