The alert hit like a hammer: someone accessed critical resources. You need to know who, what, and when—fast. Microsoft Entra makes that possible with precision.
Microsoft Entra Who Accessed What And When is not just a log. It’s a clear record of identities, actions, and timestamps across your cloud and on‑prem environments. Every sign‑in, every token, every API call is tracked. Every event is tied to the exact user identity—local or federated—and the service, file, or database they touched. This is core for audit trails, compliance checks, and breach forensics.
With Entra, you can pull this data directly from Audit Logs and Sign‑in Logs. The audit logs answer “what and when”: modifications, creations, deletions, role assignments. The sign‑in logs answer “who accessed”: successful logins, MFA usage, conditional access evaluations. Combine them, and you see the full chain—identity, resource, timestamp, IP address, device info, and policy outcome.