# About Entra Logs

Compare the purposes of Entra audit, sign-in and provisioning logs, and find the linked Microsoft references for each log type.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

## General Information about Entra Logs

- [Audit logs in Microsoft Entra ID - Microsoft Entra ID \| Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs)
- [Audit logs API overview - Microsoft Graph v1.0 \| Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/azure-ad-auditlog-overview?view=graph-rest-1.0)

Logs are available via Entra -\> Enterprise Apps -\> (choose an app) -\> Activity -\>

[Screenshot retained for review](../../review/Review-status.md#asset-e336a3c4b66e92013daa)

## Directory Audit Logs

- Purpose:
- History of every task performed in your tenant by user or a service.
- The audit log of a user in M365 shows the history changes applied to it by user or a service.
- Can Answer Questions Like
- Who granted admin group access to a directory user?
- Which users are signing in to a recently acquired app?
- How many passwords resets were made within the directory?

**Sign-In Logs** <https://learn.microsoft.com/en-us/graph/api/resources/azure-ad-auditlog-overview?view=graph-rest-1.0>

- Purpose:
- Help you determine who or what performed the tasks reported by **directory** **<u>Audit Logs</u>**
- Can Answer Questions Like
- What is the sign in pattern of a user?
- How many users have signed in during the last week?
- What's the status of these sign-ins?
- Includes:
- interactive user sign-ins
- non-interactive user sign-ins
- service principal sign-ins
- managed identity sign-ins

## Provisioning Logs

- About:
- [User provisioning logs in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-provisioning-logs)
- [How to analyze the Microsoft Entra provisioning logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-analyze-provisioning-logs)
- Purpose:
- Capture events related to the creation of users
- Can Answer Questions Liks
- What users were successfully created by PIPS+?
- What users were successfully removed from Adobe?
- What groups were successfully created in a third party service like ServiceNow?

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)