Overview
how many sign-ins, what success rate, how many accounts without MFA.
Why it was built
Entra ID keeps logs only for a limited time, and when an auditor asks what happened half a year ago, the portal has no answer. Logs are therefore collected into Log Analytics with its own retention, with an app on top where you can search without writing KQL queries.
What's in it
eight sections, each answering a different question:
Sign-ins
detail of interactive sign-ins by filter.
Security
repeated failed sign-ins by account and IP.
Account takeover
signals that someone signed in successfully when they shouldn't have.
Change audit
who changed permissions, roles and settings.
Account hygiene
a basis for quarterly reviews — inactive accounts, privileged accounts.
Service accounts
applications and service principals that reviews tend to forget.
Operations
collection health, data volume and cost estimate.
Why it's built this way
An empty table is not the same as no problem
For every view the app says whether empty means the desired state or missing evidence. Until collection has run long enough, views computed against a thirty-day threshold openly report that they can't return anything yet — instead of returning an empty table that looks like good news.
A taken-over account doesn't show up in the log as an error
An attacker with a stolen token produces no failure; in the log they look like an ordinary workday. Views in this section therefore don't measure conformance to a fixed value but deviation from the account's own history — for example one session signing in from several networks and countries at once.
A security group controls data access, not the app
Anyone not in it gets an explanation instead of data — that it's about permissions, not an error — and an instruction to write to IT; nobody adds themselves.
Logs are not a tool for supervising people
The app states it in the first place a user looks: records serve security monitoring and audit evidence, not checking people's work performance or attendance.
What it's good for
an audit trail for ISO/IEC 27001 and ISO 9001, a basis for quarterly access reviews, and the answer to “who, when, from where and with what” before anyone asks.
Tap a snapshot to enlarge it. The data in the snapshots is anonymized.