azure:signinlogs
Entra ID sign-in logs
Interactive and non-interactive sign-ins
- Host type
- Azure (platform and Entra ID)
- Tier, as a whole
- Minimum
- Cost class
- Included
- Techniques
- 38
- Rules listed
- 147
- Events
- 16
Why this tier
CISA-SCUBA-M365; CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A10 (Attack vectors and lateral movement; our analysis); OMB M-26-14 A8 (Anomalous activity; our analysis)
Licensing
- License or service
- Entra ID Free (portal); P1/P2 for export
- What is free
- Portal access on Free; 7-day retention Free, 30-day P1/P2
- What costs
- Export to Log Analytics requires P1/P2 tenant license + Azure Monitor ingestion
- Notes
- Licensing include table: Sign-in logs Free=Yes
- Vendor page
- https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/includes/licensing-monitoring-health.md
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Identity used | Supports an activity | our analysis: the signing-in identity |
| OMB M-26-14: Anomalous activity | Supports an activity | our analysis: anomalous sign-in location device and time |
| OMB M-26-14: Attack vectors and lateral movement | Supports an activity | our analysis: initial access to the tenant |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted (cloud): use of the tenant's user accounts that access and administer cloud services; authentication success and/or failures to third party services (e.g. SAML/OAuth) |
| CISA SCuBA: Audit logging policies | names_source | our analysis: Entra sign-in logs are part of the Entra audit record set the 6.3 note describes |
Techniques
- T1078.004 Cloud Accounts
- T1087 Account Discovery
- T1087.003 Email Account
- T1087.004 Cloud Account
- T1110 Brute Force
- T1110.001 Password Guessing
- T1110.002 Password Cracking
- T1110.003 Password Spraying
- T1110.004 Credential Stuffing
- T1114.002 Remote Email Collection
- T1119 Automated Collection
- T1136.003 Cloud Account
- T1189 Drive-by Compromise
- T1199 Trusted Relationship
- T1212 Exploitation for Credential Access
- T1213.002 Sharepoint
- T1213.004 Customer Relationship Management Software
- T1213.005 Messaging Applications
- T1484 Domain or Tenant Policy Modification
- T1484.002 Trust Modification
- T1526 Cloud Service Discovery
- T1530 Data from Cloud Storage
- T1531 Account Access Removal
- T1538 Cloud Service Dashboard
- T1548 Abuse Elevation Control Mechanism
- T1548.005 Temporary Elevated Cloud Access
- T1550 Use Alternate Authentication Material
- T1550.001 Application Access Token
- T1552 Unsecured Credentials
- T1556.006 Multi-Factor Authentication
- T1556.007 Hybrid Identity
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1606 Forge Web Credentials
- T1606.002 SAML Tokens
- T1621 Multi-Factor Authentication Request Generation
- T1649 Steal or Forge Authentication Certificates
- T1697 Steal Application Specific Passwords
Rules
Splunk 7
- Azure AD AzureHound UserAgent Detected
- Azure AD Multiple AppIDs and UserAgents Authentication Spike
- Azure AD Multiple Denied MFA Requests For User
- Azure AD Multiple Failed MFA Requests For User
- Azure AD Service Principal Authentication
- Azure AD User Consent Denied for OAuth Application
- Detect Distributed Password Spray Attempts
Sigma 19
- Account Disabled or Blocked for Sign in Attempts by Yochana Henderson, '@Yochana-H'
- Account Lockout by AlertIQ
- Application Using Device Code Authentication Flow by Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
- Applications That Are Using ROPC Authentication Flow by Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
- Azure AD Only Single Factor Authentication Required by MikeDuddington, '@dudders1'
- Azure Sign-In With Axios User Agent by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- Azure Unusual Authentication Interruption by Austin Songer @austinsonger
- Device Registration or Join Without MFA by Michael Epping, '@mepples21'
- Discovery Using AzureHound by Janantha Marasinghe
- Login to Disabled Account by AlertIQ
- Multifactor Authentication Denied by AlertIQ
- Multifactor Authentication Interrupted by AlertIQ
- Potential MFA Bypass Using Legacy Client Authentication by Harjot Singh, '@cyb3rjy0t'
- Sign-in Failure Due to Conditional Access Requirements Not Met by Yochana Henderson, '@Yochana-H'
- Sign-ins by Unknown Devices by Michael Epping, '@mepples21'
- Sign-ins from Non-Compliant Devices by Michael Epping, '@mepples21'
- Suspicious SignIns From A Non Registered Device by Harjot Singh, '@cyb3rjy0t'
- Use of Legacy Authentication Protocols by Yochana Henderson, '@Yochana-H'
- User Access Blocked by Azure Conditional Access by AlertIQ
Elastic 45
- Azure Service Principal Sign-In Followed by Arc Cluster Credential Access
- Entra ID ADRS Token Request by Microsoft Authentication Broker
- Entra ID AiTM Phishing-Kit Chain Detected
- Entra ID Concurrent Sign-in with Suspicious Properties
- Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN
- Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP
- Entra ID Device-Bound PRT from Unusual Device IP
- Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration
- Entra ID Excessive Account Lockouts Detected
- Entra ID High Risk Sign-in
- Entra ID High Risk User Sign-in Heuristic
- Entra ID Kali365 Default User-Agent Detected
- Entra ID MFA TOTP Brute Force Attempted
- Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN
- Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource
- Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent
- Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource
- Entra ID OAuth Device Code Flow with Concurrent Sign-ins
- Entra ID OAuth Device Code Grant by Microsoft Authentication Broker
- Entra ID OAuth Device Code Grant by Unusual User
- Entra ID OAuth Device Code Phishing via AiTM
- Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration
- Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)
- Entra ID OAuth PRT Issuance to Non-Managed Device Detected
- Entra ID OAuth Phishing via First-Party Microsoft Application
- Entra ID OAuth ROPC Grant Login Detected
- Entra ID OAuth User Impersonation to Microsoft Graph
- Entra ID OAuth user_impersonation Scope for Unusual User and Client
- Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA)
- Entra ID PowerShell Sign-in
- Entra ID ROPC Authentication with Unknown Client ID
- Entra ID Service Principal Federated Credential Authentication by Unusual Client
- Entra ID Service Principal with Unusual Source ASN
- Entra ID Sharepoint or OneDrive Accessed by Unusual Client
- Entra ID Sign-in BloodHound Suite User-Agent Detected
- Entra ID Sign-in Brute Force Attempted (Microsoft 365)
- Entra ID Sign-in TeamFiltration User-Agent Detected
- Entra ID User Sign-In via Unusual Legacy Authentication Client
- Entra ID User Sign-in Brute Force Attempted
- Entra ID User Sign-in with Unusual Authentication Type
- Entra ID User Sign-in with Unusual Client
- Entra ID User Sign-in with Unusual Non-Managed Device
- Entra ID Windows Hello or Passkey Sign-in from Unregistered Device
- M365 or Entra ID Identity Sign-in from a Suspicious Source
- Microsoft Entra ID Impossible Travel Sign-in
Microsoft Sentinel 76
- Account Created and Deleted in Short Timeframe
- Account created from non-approved sources
- Anomalous Single Factor Signin
- Anomalous login followed by Teams action
- Anomalous sign-in location by user account and authenticating application
- Anomaly Sign In Event from an IP
- Attempt to bypass conditional access rule in Microsoft Entra ID
- Attempts to sign in to disabled accounts
- Authentication Attempt from New Country
- Authentications of Privileged Accounts Outside of Expected Controls
- Azure Portal sign in from another Azure Tenant
- Brute Force Attack against GitHub Account
- Brute force attack against Azure Portal
- Brute force attack against an Entra-authenticated Windows device
- Cisco - firewall block but success logon to Microsoft Entra ID
- Cross-Cloud Password Spray detection
- Cross-Cloud Unauthorized Credential Access Detection From AWS RDS Login
- Dataverse - Suspicious use of Web API
- Distributed Password cracking attempts in Microsoft Entra ID
- Expired access credentials being used in Azure
- External guest invitation followed by Microsoft Entra ID PowerShell signin
- F&O - Unusual sign-in activity using single factor authentication
- Failed AWS Console logons but success logon to AzureAD
- Failed AzureAD logons but success logon to AWS Console
- Failed AzureAD logons but success logon to host
- Failed host logons but success logon to AzureAD
- Failed login attempts to Azure Portal
- Failed sign-ins into LastPass due to MFA
- GitHub Signin Burst from Multiple Locations
- GitLab - SSO - Sign-Ins Burst
- GreyNoise TI Map IP Entity to SigninLogs
- High risk Office operation conducted by IP Address that recently attempted to log into a disabled account
- High-Risk Cross-Cloud User Impersonation
- HoneyLabs TI Map IP Entity to SigninLogs
- IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN
- Insider Risk_Risky User Access By Application
- Insider Risk_Sensitive Data Access Outside Organizational Geo-location
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Lumen TI IPAddress in IdentityLogonEvents
- Lumen TI IPAddress in SigninLogs
- MFA Rejected by User
- MFA Spamming followed by Successful login
- Malformed user agent
- Microsoft Entra ID PowerShell accessing non-Entra ID resources
- Microsoft Entra ID Rare UserAgent App Sign-in
- Microsoft Entra ID UserAgent OS Missmatch
- New country signIn with correct password
- PRODAFT USTA - Compromised credential used in successful sign-in
- Password spray attack against Microsoft Entra ID Seamless SSO
- Password spray attack against Microsoft Entra ID application
- Possible AiTM Phishing Attempt Against Microsoft Entra ID
- Possible SignIn from Azure Backdoor
- Power Apps - App activity from unauthorized geo
- Power Platform - Possibly compromised user accesses Power Platform services
- Privileged Accounts - Sign in Failure Spikes
- Privileged User Logon from new ASN
- Repeated failed MFA challenges for one user from one IP (AADSTS50074 / AADSTS500121)
- Risky user signin observed in non-Microsoft network device
- Service Principal Authentication Attempt from New Country
- Sign-ins from IPs that attempt sign-ins to disabled accounts
- Speculus - Sign-in attempt from high-risk IP indicator
- Successful logon from IP and failure from a different IP
- Suspicious Login from deleted guest account
- Suspicious Service Principal creation activity
- TI Map Email entity to SigninLogs
- TI Map IP Entity to SigninLogs
- TI Map IP Entity to SigninLogs
- TI map Email entity to SigninLogs
- ThreatConnect TI map Email entity to SigninLogs
- URL Added to Application from Unknown Domain
- Unauthorized user access across AWS and Azure
- Unusual Volume of file deletion by users
- User Accounts - Sign in Failure due to CA Spikes
- User agent search for log4j exploitation attempt
- [Deprecated] Explicit MFA Deny
- [Entra ID] Suspicious Continuous OAuth Token Usage