When an organization experiences a security scare or a suspected compromised credential, the first place to look is the Microsoft Entra ID sign-in logs. This tutorial provides a comprehensive guide on exactly where to find and navigate these logs within the admin center and Azure Portal.
Microsoft Entra ID Sign-In Logs Where to Find
Prerequisites: Permissions and Licensing Requirements
Before attempting to access Microsoft Entra ID sign-in logs, you must ensure that your administrative user account possesses the necessary authorization levels and license tiers. Identity data is highly sensitive, and Microsoft enforces strict role-based access control (RBAC) boundaries over who can view it.
Required Administrative Directory Roles
You do not need full Global Administrator rights to view identity telemetry. To implement the principle of least privilege, assign one of these specialized security roles:
- Security Reader: Allows view-only access to sign-in logs, security alerts, and conditional access configurations. Excellent for junior analysts or auditing teams.
- Security Administrator: Provides full read and write access to security telemetry, identity protection policies, and sign-in metrics.
- Global Reader: Provides sweeping, view-only access to all configuration states and monitoring dashboards across the entire Microsoft 365 tenant.
Licensing Thresholds and Retention Boundaries
While basic login data is available across all license types, the depth of details and log history retention windows change drastically depending on your Microsoft Entra tier.
| License Tier | Retention Window | Advanced Filtering & Telemetry Features |
| Microsoft Entra ID Free | 7 Days | Basic interactive user logs only; lacks advanced conditional access context. |
| Microsoft Entra ID P1 | 30 Days | Full access to non-interactive, service principal, and managed identity tracking. |
| Microsoft Entra ID P2 | 30 Days | Includes P1 logging plus advanced Identity Protection risky sign-in correlation analytics. |
Architect’s Strategy Tip: A 30-day default retention window is completely inadequate for compliance standard audits (like SOC 2 or HIPAA), which typically require keeping logs for a year or more. To solve this limitation, navigate to Diagnostic settings in Entra ID and stream your log events to an Azure Log Analytics workspace, Azure Storage account, or an external SIEM tool like Microsoft Sentinel for long-term archiving.
Step-by-Step Tutorial: Where to Find Entra ID Sign-In Logs
Let’s walk through the exact portal sequence required to locate the primary tracking dashboards inside the Microsoft cloud administration interface.
Approach- 1: Using Microsoft Admin Center
Open your preferred web browser and go to the centralized Microsoft Entra admin center directly at entra.microsoft.com. Log in using your corporate administrative credentials.