In this post, I show you how to access sign in logs in Microsoft 365.
Microsoft logs sign in activity for interactive user signs-ins and non-interactive sign-ins. As an Administrator, you may need to review a user’s sign in activity for auditing and security purposes. Microsoft 365 makes it easy to review the sign in Activity, but it does come with some limitations.
Table of Contents
- Requirements to View Sign in Logs
- View Sign in Logs for All Users
- View Failed Sign-in Events
- View Sign in Logs for a Single User
Requirements to View Sign in Logs
To view sign in logs you must have one of the following roles:
- Global Administrator
- Security Administrator
- Compliance Administrator
- Report Reader
Sign-in Log Retention
- Entra ID Free = 7 Days
- Entra ID P1 = 30 days
- Entra ID P2 = 30 days
To learn more, refer to the article Microsoft Entra data retention.
View Sign in Logs for All Users
Step 1: Log into Microsoft 365 Admin Center
Step 2: On the left-hand side under Admin Centers select “Identity”
Step 3: Once on the Entra page, select “Sign-in logs”
From here you can view your list of sign-in logs.
At the top of the page, you can filter the time frame, show dates as “Local” or “UDT” and apply filters.
If you want to filter for a specific user select Add Filters Select User, then apply.
Type in the user and select apply.
A list for that users sign in logs will appear.
View Failed Sign in Logs
By default, the status will show all sign in events (Success and failure). To view only failed events following these steps.
- Click on Add filters
- Select Status
- Select Failure
View Sign in Logs for a Single User
Step 1: Log into Microsoft 365 Admin Center
Step 2: On the left-hand side under Admin Centers select “Identity”
Step 3: On the left side select Users > All Users
Step 4: Search for the user and select it.
Step 5: Once the user is select click “Sign in logs” on the left side of the page.
From here you can view the users sign in logs.
