An identity-provider (IdP) sign-in log can show that authentication succeeded and, on platforms such as Microsoft Entra, which access policies were evaluated. It may not explain the entire access decision. To understand why access was allowed, check the authentication evidence, policy results and change history—then look at the application or resource’s authorization records if the question remains unresolved.
What an IdP sign-in log can—and cannot—tell you
A sign-in event is evidence about an authentication event and, depending on the identity provider, the policies evaluated during it. It is not necessarily a complete account of every decision that led to a user reaching a particular feature or resource. In Microsoft Entra, the event’s Conditional Access and Authentication Details views help explain the identity-provider side of the decision. The application or resource may make a separate authorization decision after authentication.
As an Amazon Associate I earn from qualifying purchases.
Microsoft describes Conditional Access policies as “if-then statements: if a user wants to access a resource, then they must complete an action.” Microsoft Learn: Conditional Access policy engine
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to investigate an unexpected allow in Microsoft Entra
- Find and verify the event. Open the relevant sign-in record and confirm the account, client application, target resource and event time. Entra displays sign-in time in the administrator portal’s time zone. If you are comparing portal records with Log Analytics, distinguish the event time from the ingestion time. Use correlation information to connect related requests. Microsoft Learn: Sign-in logs
- Read Authentication Details. Review the methods and steps shown for the event. A requirement may have been met by a claim in a prior token rather than by a new prompt, so the event does not necessarily represent a fresh user interaction. Microsoft Learn: Sign-in logs Microsoft Learn: Sign-in activity details
- Check each Conditional Access result. Open the event’s Conditional Access tab and examine the result for each policy, including whether it was enabled, report-only or not applied. Compare the targeted user and resource with the event. A policy result of “Success” does not by itself prove that every conceivable control was met; interpret it in the context of that policy and its evaluated conditions. “Not Applied” may reflect unmatched conditions or documented exceptions. Conditional Access governs access to cloud resources, not the local Windows sign-in itself. Microsoft Learn: Sign-in logs Microsoft Learn: Troubleshoot Conditional Access
- Look for policy changes near the event. In Entra Audit logs, filter for Conditional Access activity and inspect relevant additions, updates or deletions. Review the Modified properties on an entry, then compare the changed configuration with the policy evaluation recorded in the sign-in event. Microsoft Learn: View audit logs Microsoft Learn: Troubleshoot policy changes
- Use diagnostics when the event is inconclusive. Review Sign-in diagnostics for its analysis and recommendations. For unfamiliar authentication-flow behavior, Microsoft’s guidance includes evaluating the flow in report-only mode or filtering sign-in logs for the relevant flow. Microsoft Learn: Sign-in diagnostics Microsoft Learn: Troubleshoot Conditional Access with the What If tool
- Continue at the next decision layer if needed. If the IdP records successful authentication but the user could not use a feature—or could use something unexpected—check the application or resource’s own authorization logs and policies. AWS documents a further policy evaluation for console access after authentication; that is an example of a separate decision layer, not a universal sequence for every service. AWS: Control access to temporary credentials
Interpret the evidence by decision layer
| Question | Evidence to inspect | What it helps establish |
|---|---|---|
| Who signed in, to what, and when? | Account, client application, resource, event time and correlation information in the sign-in record. Microsoft Learn | Which event you are investigating and which related requests may belong with it. |
| How was authentication satisfied? | Authentication Details, including methods, sequence and any prior token claim. Microsoft Learn | Whether the evidence shows a new interaction or a requirement met through an earlier claim. |
| Which identity-provider policies were involved? | Conditional Access results, policy scope, conditions and controls, plus enabled or report-only status. Microsoft Learn Microsoft Learn | Whether a policy applied and how its recorded evaluation relates to the event. |
| Did the configuration change? | Conditional Access entries in Audit logs and their Modified properties. Microsoft Learn | Whether a policy was created, updated or deleted around the event, and what properties changed. |
| Was access to the feature or resource authorized? | The application’s or resource’s own authorization records and policy evidence. | Whether a separate decision after IdP authentication explains the outcome. |
Check whether the records still exist
Microsoft says Entra audit-log data is retained for 30 days by default. This is a documented Entra audit-log default, not a universal retention period for all identity providers, log types or tenant configurations. If the relevant event or policy change is older, check whether your organization exported logs before they expired; Microsoft lists Log Analytics, a storage account, Event Hubs and partner solutions as export destinations. Microsoft Learn: Data retention
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Access to log and policy views depends on the platform and the permissions assigned to your account. Microsoft documents the roles and permissions needed for the relevant Entra views in its sign-in logs and policy-change troubleshooting guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Apply the same reasoning to other identity providers
The workflow above uses Microsoft Entra field names and behavior; other IdPs may use different labels, retention periods and policy models. The general diagnostic distinction still matters: evidence of authentication is not automatically evidence that every later application or resource authorization check succeeded—or explains why it did.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
