Skip to main content

sign_ins

Creates, updates, deletes, gets or lists a sign_ins resource.

Overview​

Namesign_ins
TypeResource
Identra_id.audit_logs.sign_ins

Fields​

The following fields are returned by SELECT queries:

Retrieved navigation property

NameDatatypeDescription
idstringThe unique identifier for an entity. Read-only.
appDisplayNamestringApp name displayed in the Microsoft Entra admin center. Supports $filter (eq, startsWith).
appIdstringUnique GUID that represents the app ID in the Microsoft Entra ID. Supports $filter (eq).
appliedConditionalAccessPoliciesarrayProvides a list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see Permissions for viewing applied conditional access (CA) policies in sign-ins.
clientAppUsedstringIdentifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients. Supports $filter (eq).
conditionalAccessStatusReports status of an activated conditional access policy. The possible values are: success, failure, notApplied, and unknownFutureValue. Supports $filter (eq).
correlationIdstringThe request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity. Supports $filter (eq).
createdDateTimestring (date-time)Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z. Supports $orderby, $filter (eq, le, and ge). (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
deviceDetailDevice information from where the sign-in occurred; includes device ID, operating system, and browser. Supports $filter (eq, startsWith) on browser and operatingSytem properties.
ipAddressstringIP address of the client used to sign in. Supports $filter (eq, startsWith).
isInteractivebooleanIndicates whether a sign-in is interactive.
locationProvides the city, state, and country code where the sign-in originated. Supports $filter (eq, startsWith) on city, state, and countryOrRegion properties.
resourceDisplayNamestringName of the resource the user signed into. Supports $filter (eq).
resourceIdstringID of the resource that the user signed into. Supports $filter (eq).
riskDetailThe reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far. Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.
riskEventTypesarray
riskEventTypes_v2arrayThe list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue. Supports $filter (eq, startsWith).
riskLevelAggregatedAggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection. Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.
riskLevelDuringSignInRisk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection. Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.
riskStateReports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue. Supports $filter (eq).
statusSign-in status. Includes the error code and description of the error (if a sign-in failure occurs). Supports $filter (eq) on errorCode property.
userDisplayNamestringDisplay name of the user that initiated the sign-in. Supports $filter (eq, startsWith).
userIdstringID of the user that initiated the sign-in. Supports $filter (eq).
userPrincipalNamestringUser principal name of the user that initiated the sign-in. This value is always in lowercase. For guest users whose values in the user object typically contain #EXT# before the domain part, this property stores the value in both lowercase and the 'true' format. For example, while the user object stores AdeleVance_fabrikam.com#EXT#@contoso.com, the sign-in logs store adelevance@fabrikam.com. Supports $filter (eq, startsWith).

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectsign_in_idRetrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.
listselectRetrieve the Microsoft Entra user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs. The maximum and default page size is 1,000 objects and by default, the most recent sign-ins are returned first. Only sign-in events that occurred within the Microsoft Entra ID default retention period are available.
updateupdatesign_in_id
deletedeletesign_in_idIf-Match
confirm_compromisedexecMark an event in the Microsoft Entra sign-in logs as risky. Events marked as risky by an admin are immediately flagged as high risk in Microsoft Entra ID Protection, overriding previous risk states. Admins can confirm that events flagged as risky by Microsoft Entra ID Protection are in fact risky. For details about investigating Identity Protection risks, see How to investigate risk.
confirm_safeexecMark an event in Microsoft Entra sign-in logs as safe. Admins can either mark the events flagged as risky by Microsoft Entra ID Protection as safe, or they can mark unflagged events as safe. For details about investigating Identity Protection risks, see How to investigate risk.
dismissexecMark an event in Microsoft Entra sign-in logs as dismissed. For details about investigating Identity Protection risks, see How to investigate risk.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
sign_in_idstringThe unique identifier of signIn
If-MatchstringETag

SELECT examples​

Retrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.

SELECT
id,
appDisplayName,
appId,
appliedConditionalAccessPolicies,
clientAppUsed,
conditionalAccessStatus,
correlationId,
createdDateTime,
deviceDetail,
ipAddress,
isInteractive,
location,
resourceDisplayName,
resourceId,
riskDetail,
riskEventTypes,
riskEventTypes_v2,
riskLevelAggregated,
riskLevelDuringSignIn,
riskState,
status,
userDisplayName,
userId,
userPrincipalName
FROM entra_id.audit_logs.sign_ins
WHERE sign_in_id = '{{ sign_in_id }}' -- required
;

UPDATE examples​

No description available.

UPDATE entra_id.audit_logs.sign_ins
SET 
id = '{{ id }}',
appDisplayName = '{{ appDisplayName }}',
appId = '{{ appId }}',
appliedConditionalAccessPolicies = '{{ appliedConditionalAccessPolicies }}',
clientAppUsed = '{{ clientAppUsed }}',
conditionalAccessStatus = '{{ conditionalAccessStatus }}',
correlationId = '{{ correlationId }}',
createdDateTime = '{{ createdDateTime }}',
deviceDetail = '{{ deviceDetail }}',
ipAddress = '{{ ipAddress }}',
isInteractive = {{ isInteractive }},
location = '{{ location }}',
resourceDisplayName = '{{ resourceDisplayName }}',
resourceId = '{{ resourceId }}',
riskDetail = '{{ riskDetail }}',
riskEventTypes = '{{ riskEventTypes }}',
riskEventTypes_v2 = '{{ riskEventTypes_v2 }}',
riskLevelAggregated = '{{ riskLevelAggregated }}',
riskLevelDuringSignIn = '{{ riskLevelDuringSignIn }}',
riskState = '{{ riskState }}',
status = '{{ status }}',
userDisplayName = '{{ userDisplayName }}',
userId = '{{ userId }}',
userPrincipalName = '{{ userPrincipalName }}'
WHERE 
sign_in_id = '{{ sign_in_id }}' --required
RETURNING
id,
appDisplayName,
appId,
appliedConditionalAccessPolicies,
clientAppUsed,
conditionalAccessStatus,
correlationId,
createdDateTime,
deviceDetail,
ipAddress,
isInteractive,
location,
resourceDisplayName,
resourceId,
riskDetail,
riskEventTypes,
riskEventTypes_v2,
riskLevelAggregated,
riskLevelDuringSignIn,
riskState,
status,
userDisplayName,
userId,
userPrincipalName;

DELETE examples​

No description available.

DELETE FROM entra_id.audit_logs.sign_ins
WHERE sign_in_id = '{{ sign_in_id }}' --required
AND If-Match = '{{ If-Match }}'
;

Lifecycle Methods​

Mark an event in the Microsoft Entra sign-in logs as risky. Events marked as risky by an admin are immediately flagged as high risk in Microsoft Entra ID Protection, overriding previous risk states. Admins can confirm that events flagged as risky by Microsoft Entra ID Protection are in fact risky. For details about investigating Identity Protection risks, see How to investigate risk.

EXEC entra_id.audit_logs.sign_ins.confirm_compromised 
@@json=
'{
"requestIds": "{{ requestIds }}"
}'
;