Translated from 日本語 • View original 
Sign-in Log
Log information when a user or application authenticates through Entra ID.
The main log information is as follows:
- Username and sign-in time
- Client IP address
- Device information, browser, OS
- Sign-in success/failure
- Conditional access status
- MFA availability
- Geolocation (IP geolocation)
In other words, it is a log that contains all the information about signing in.
Where can I find it? You can check it in the Microsoft Entra admin center under "Monitoring and health" > "Sign-in logs".
You can also download the logs in JSON or CSV.
How to Use Logs
- Detect unauthorized sign-ins
- Access from a geographically unusual location (e.g., a user living in Tokyo suddenly logged in from Russia)
- Unusual movement (e.g., logging in from the US 5 minutes after logging in from Tokyo)
- Respond to inquiries from users about "unable to log in"
- See why it failed in the sign-in log to speed up cause identification and support response
- Examples of common reasons for failure:
- Wrong password
- MFA not registered or failed
- Blocking by conditional access (e.g., non-compliant devices)
- Access from apps that don't allow sign-in
Audit Logs
Log information that records configuration changes and management operations that occur within Entra ID.
The main log information is as follows:
- Create, delete, and update user accounts
- Change groups and roles
- Add or change the configuration of the application
- Conditional Access policy changes
- Administrator's operation history
Where can you find it in the Microsoft Entra admin center under "Monitoring and health" > "Audit logs".
As with sign-in logs, you can download logs as JSON or CSV.
How to Use Logs
- Detection of unauthorized operations by administrators
- Detect unintentional additions/deletions of user accounts, etc.
- Audit response and submission of trails
- Presentation of operational trails required for ISMS, SOC2, GDPR, etc. audits
- Specific examples:
- "Please provide 3 months of operation history for granting or deleting administrator roles."
- "I want to check the change history of the access control policy"
Log Retention Period
Depending on your Entra ID plan, both sign-in and audit logs are as follows: (As of June 1, 2025)
- Entra ID Free: 7 days
- Entra ID P1, P2: 30 days
Please check the official documentation below for details.
Microsoft Entra data retention period
Conclusion
In this article, we explained the logs that can be obtained with Entra ID, namely sign-in logs and audit logs.
Each log is a security and governance evidence and warning light that is critical to the secure operation of your Entra ID environment.
The sign-in log provides a history of how a user or attacker attempted to authenticate.
Audit logs show the history of what administrators and systems have done and changed.
If these logs are not checked or utilized regularly, you may miss critical risks, such as:
- Signs of unauthorized access (e.g., suspicious sign-in from abroad)
- Unintentional configuration changes (e.g., someone had disabled Conditional Access)
- Internal fraud or misoperation by administrators
In other words, rather than "I have a safe place to keep the logs," "having a system that allows you to see, notice, and act on the logs" leads to true peace of mind.
It is important for Entra managers to be aware of treating these logs as "assets that should be checked on a daily basis" rather than "only being seen when something happens".
However, even if you check these logs on a daily basis, you often don't know what to do without security expertise.
Therefore, in order to implement continuous and effective security measures, an operational system (SOC) with a dedicated team is essential.
We provide SOC services for companies using Microsoft 365 and fully support the monitoring and operation of Microsoft environments, including Entra.
In addition to Microsoft 365, we also support the following security products, and by integrating monitoring and operating multiple products, we will strengthen your company's security posture.
・WAF (AWS WAF, Azure WAF, etc.)
EDR (Cybereason, CrowdStrike, etc.)
SaaS (Slack, Dropbox, etc.)
Firewall (Fortigate, Meraki, etc.)
PC operation log (SKYSEA Client) View, LANSCOPE Endpoint Manager, etc.)
Companies that want to achieve stronger defenses while reducing the operational burden of security should consider implementing Colorkrew Security.