About Entra Logs
In
Compare the purposes of Entra audit, sign-in and provisioning logs, and find the linked Microsoft references for each log type.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
General Information about Entra Logs
- Audit logs in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn
- Audit logs API overview - Microsoft Graph v1.0 | Microsoft Learn
Logs are available via Entra -> Enterprise Apps -> (choose an app) -> Activity ->
Screenshot retained for review
Directory Audit Logs
- Purpose:
- History of every task performed in your tenant by user or a service.
- The audit log of a user in M365 shows the history changes applied to it by user or a service.
- Can Answer Questions Like
- Who granted admin group access to a directory user?
- Which users are signing in to a recently acquired app?
- How many passwords resets were made within the directory?
Sign-In Logs https://learn.microsoft.com/en-us/graph/api/resources/azure-ad-auditlog-overview?view=graph-rest-1.0
- Purpose:
- Help you determine who or what performed the tasks reported by directory Audit Logs
- Can Answer Questions Like
- What is the sign in pattern of a user?
- How many users have signed in during the last week?
- What's the status of these sign-ins?
- Includes:
- interactive user sign-ins
- non-interactive user sign-ins
- service principal sign-ins
- managed identity sign-ins
Provisioning Logs
- About:
- User provisioning logs in Microsoft Entra ID
- How to analyze the Microsoft Entra provisioning logs
- Purpose:
- Capture events related to the creation of users
- Can Answer Questions Liks
- What users were successfully created by PIPS+?
- What users were successfully removed from Adobe?
- What groups were successfully created in a third party service like ServiceNow?