Entra ID sign-in logs are a goldmine of security intelligence — but most tenants never look at them. Here's what Optimyze reviews in every monthly client check and what patterns indicate a problem.
Key takeaways
- 1Failed sign-ins from foreign countries — unusual source countries for your business (e.g. Nigeria, Russia, China) indicate credential stuffing attempts against your users
- 2Successful sign-ins from unusual locations — if a user normally signs in from Auckland and suddenly signs in from Amsterdam, this needs investigation
- 3Legacy authentication sign-ins — if you've blocked legacy auth in Conditional Access, any log entry showing legacy auth protocol indicates a misconfiguration or an exemption that s
- 4Interrupted sign-ins blocked by Conditional Access — confirms policies are working; a sudden drop in blocks might indicate a policy was accidentally disabled
- 5Service account activity — unusual activity from application service accounts can indicate a compromised app registration
Entra ID logs every authentication event in your Microsoft 365 tenant. Every user sign-in, every failed attempt, every conditional access policy evaluation, every token refresh. This data is available in the Entra portal (entra.microsoft.com) under Sign-in logs, and it's one of the richest security data sources available to an MSP.
What Optimyze looks for in sign-in logs
- Failed sign-ins from foreign countries — unusual source countries for your business (e.g. Nigeria, Russia, China) indicate credential stuffing attempts against your users
- Successful sign-ins from unusual locations — if a user normally signs in from Auckland and suddenly signs in from Amsterdam, this needs investigation
- Legacy authentication sign-ins — if you've blocked legacy auth in Conditional Access, any log entry showing legacy auth protocol indicates a misconfiguration or an exemption that shouldn't exist
- Interrupted sign-ins blocked by Conditional Access — confirms policies are working; a sudden drop in blocks might indicate a policy was accidentally disabled
- Service account activity — unusual activity from application service accounts can indicate a compromised app registration
The risky users report
The Risky Users report in Entra ID Identity Protection shows users who have been flagged by Microsoft's machine learning as potentially compromised. Optimyze reviews this report for every client monthly. Users flagged as High risk are contacted immediately, their credentials reset, and their sessions revoked — regardless of whether they've noticed anything unusual.
Retention: 7 days vs 30 days vs longer
Free Entra tenants retain sign-in logs for 7 days. Entra ID P1 (included in Business Premium) extends this to 30 days. For clients needing longer retention (compliance requirements, incident investigation), Optimyze configures Log Analytics workspace archiving to retain data for up to 2 years.
