Entra Sign-in Logs
You review entra sign in logs in your directory portal to track every login attempt. These records show who logged in, which app they opened, and whether the login worked. Security teams check these events each day to spot strange locations or failed password checks. When teams grant broad roles, a valid login still gives users wide database permissions. How entra sign in logs work in your directory Your cloud directory records an event each time a person or service tries to log in. This proc
PII in Logs Prevention + Single Sign-On (SSO): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You review entra sign in logs in your directory portal to track every login attempt. These records show who logged in, which app they opened, and whether the login worked. Security teams check these events each day to spot strange locations or failed password checks. When teams grant broad roles, a valid login still gives users wide database permissions.
How entra sign in logs work in your directory
Your cloud directory records an event each time a person or service tries to log in. This process covers interactive user logins, background token refreshes, and automated service calls. Each record holds the user identity, the target app, the device state, and the network address. It also shows which conditional rules ran during the login check.
Admins often route these event streams to a central log workspace for long-term storage. Once the data lands in a log store, teams write alerts for risky login patterns. For example, an alert can fire when a login comes from an unknown country. Teams also check these records to fix broken multi-factor prompts for staff members.
How to filter and read login events
Start by picking the right log category for the problem you want to solve. User events show when a real person types in a password or passes a prompt. Non-interactive events show when a client app refreshes a token in the background. Service principal events track when automated scripts or background jobs log in on their own.
Next, narrow the time window to the exact hour when the issue happened. Filter the list by the user account or the specific target app name. Check the status field to see the error code if a login failed. Look at the conditional rule tab to see which policy blocked the user.
PII in Logs Prevention + Single Sign-On (SSO): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What login logs solve and what they miss
Directory logs do a great job of proving who passed the front door. They help auditors verify that multi-factor rules work across the whole company. They also help incident teams trace when an attacker tried to guess a password. If a login fails at the directory level, the log gives you the exact reason.
Still, directory events stop recording the moment the user gets a valid session token. They do not show what an engineer does inside a database or cloud server after login. Once a user opens a database session, directory logs cannot see the queries they run. If a query reads customer emails, phone numbers, or card numbers, the login log stays silent. To control active sessions, teams need controls that inspect commands in flight and mask fields.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between interactive and non-interactive sign in logs?
Interactive logs track logins where a person types credentials or approves a multi-factor prompt. Non-interactive logs track background calls where an app refreshes a token without user input.
Do entra sign in logs show which database queries a user ran?
No, directory logs only record the initial login and token events for the app. They do not capture SQL statements, shell commands, or API payloads inside the active session.
How can teams keep sign in logs for compliance audits?
Built-in directory portals only keep login history for a short window of days. Teams export these logs to an external storage account or security tool for long-term retention.