Microsoft Entra Sign-in Logs Audit Logs Official Documentation
Security audits require clear records of every user login and role change. Engineering teams meet this need with microsoft entra sign in logs audit logs official documentation. These records show who logged in and what settings changed. Still, identity logs only show the front door of your cloud systems. Teams must also record actual database queries and system commands during work sessions. Using microsoft entra sign in logs audit logs official documentation for audits Auditors check two mai
Microsoft Entra ID (Azure AD) + Kubernetes Audit Logs: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
Security audits require clear records of every user login and role change. Engineering teams meet this need with microsoft entra sign in logs audit logs official documentation. These records show who logged in and what settings changed. Still, identity logs only show the front door of your cloud systems. Teams must also record actual database queries and system commands during work sessions.
Using microsoft entra sign in logs audit logs official documentation for audits
Auditors check two main types of records in your identity system. Sign-in logs track when a user or app logs in. They show the time, the user name, the app, and the login status. Audit logs record changes made inside the directory itself. They show when an admin adds a user or updates a group role.
Compliance rules like SOC 2 Type II and ISO 27001 demand these records. Health and finance standards such as HIPAA, PCI DSS, and SOX also require them. Teams facing GDPR or FedRAMP reviews must keep these records safe too. Reviewers ask for proof that only approved staff can enter production systems. They also want proof that teams review these logs on a set schedule.
Identity logs do have a clear limit during an audit review. They prove that an engineer logged into a cloud console at nine in the morning. They do not show what that engineer did inside the database five minutes later. Auditors now ask for deeper evidence that covers the whole work session. Teams need a clear trail from the first login to the final command.
Why identity reviews need runtime command logs and data masking
Periodic role reviews help managers remove old permissions from staff accounts. Identity logs tell you if a developer still uses a given role. Yet they cannot tell you if that person ran risky commands. Runtime logs fill this gap by recording every query and command run. Each action links back to the exact person who logged in.
When an engineer runs a database query, the system records the text and time. If a script updates a server, the log captures that exact step. This detail makes audit prep much faster for engineering managers. You can hand the auditor a complete record of both logins and actions. You no longer have to guess what happened after a login finished.
Microsoft Entra ID (Azure AD) + Kubernetes Audit Logs: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Runtime controls also protect sensitive data during live support work. Masking rules rewrite matched fields in query results before they reach the screen. This protects private details like emails, phone numbers, card numbers, and national IDs. Engineers can fix bugs in production while sensitive fields stay masked in results. Your audit trail then shows both the query and the fact that masking ran.
How to pair directory logs with session controls
Start by sending your directory sign-in and audit logs to a central log store. Set retention times that match your industry rules for audit evidence. Next, connect your identity provider to your runtime session tool. This links each user identity to every database query or server command they run.
Set up approval rules for high-risk roles and production databases. When an engineer asks for a session, a manager can approve it in chat. That approval, the sign-in event, and the commands all tie together. During your next review, you can show a clean chain of events. This satisfies both your internal security team and outside auditors.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between Entra sign-in logs and audit logs?
Sign-in logs show when users or apps log into your directory. Audit logs show changes to users, groups, roles, and app settings.
Do directory logs record database queries run by engineers?
No, directory logs only track the login event and directory changes. You need runtime command logging to record database queries and server commands.
How does data masking help during security audits?
Masking rewrites matched fields like emails, card numbers, and national IDs in results. This proves to auditors that live queries follow strict data privacy rules.