MELTr
Home Vendors Search Download
Login
Vendors / Microsoft Corporation / Azure Active Directory / Azure AD Sign-in Logs
Microsoft Corporation logo

Event type

Azure AD Sign-in Logs

User authentication and access events

Azure Active Directory sign-in logs capturing user authentication events with detailed device, location, and security context

JSON 22 fields High Generator

azure-ad authentication signin identity mfa conditional-access audit
Preview Sample View Schema
CLI Install
meltr templates install microsoft

Overview

What this event covers

Comprehensive authentication logs from Azure Active Directory capturing user sign-in events, multi-factor authentication, conditional access policy evaluation, and device compliance status. Essential for security monitoring and compliance reporting.

When generated

  • ›Every time a user signs into any Azure AD connected application
  • ›During multi-factor authentication challenges
  • ›When conditional access policies are evaluated
  • ›During password changes and user registration events
  • ›For both interactive and non-interactive authentication

Security relevance

High

Compliance

SOC 2 GDPR HIPAA PCI DSS NIST Cybersecurity Framework ISO 27001 FedRAMP

Frequency notes

Very high frequency in enterprise environments (1200+ events/hour baseline). Peak activity during business hours with 3x multiplier. Reduced activity nights/weekends but never zero due to automated services and global workforce.

Resources

Docs and tools

Azure Active Directory Sign-in Logs official Azure Monitor Activity Log Schema official Conditional Access Documentation official Azure AD Risk Detections official Azure Portal - Azure Active Directory Web interface for viewing and managing Azure AD sign-in logs and security reports Microsoft Graph API Programmatic access to Azure AD sign-in logs and security data Azure Monitor Log Analytics Advanced querying and analysis platform for Azure AD logs using KQL Microsoft Sentinel SIEM solution with built-in Azure AD analytics and threat detection

Generation

Configuration

Base frequency
1200 events/hour
Time patterns
business_hours night_hours weekend
Business hours
3.0x
Night hours
0.3x
Weekend
0.5x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

Level
Integer Required

Log level severity (1=Critical, 2=Error, 3=Warning, 4=Information)

Source: random_int(1, 4)

Example 4
Values
  • 1 Critical events
  • 2 Error events
  • 3 Warning events
  • 4 Informational events
callerIpAddress
String Required

Public IP address from which the authentication request originated

Source: random_public_ip()

Format IPv4 or IPv6
Example 203.0.113.42
category
String Required

Category of the Azure AD log entry

Source: Random from predefined categories

Example SignInLogs
Values
  • SignInLogs User sign-in activities
  • AuditLogs Administrative and configuration changes
  • RiskyUsers Users identified as potentially compromised
  • UserRiskEvents Risk detection events for users
  • ApplicationSignInSummary Aggregated application sign-in data
correlationId
String Required

Unique identifier for correlating related events across services

Source: random_guid()

Format UUID
Example a1b2c3d4-e5f6-7890-abcd-ef1234567890
durationMs
String Required

Duration of the authentication process in milliseconds

Source: random_int(100, 5000)

Example 1250
identity
String Required

Username of the authenticating user

Source: registry.get_random_user().username

Example john.doe
location
String Required

ISO country code where the authentication originated

Source: Random from location data

Example US
operationName
String Required

Type of authentication operation performed

Source: Random from operation types

Example Sign-in activity
Values
  • Sign-in activity Standard user authentication
  • Password change User password modification
  • User registration New user account creation
  • MFA authentication Multi-factor authentication challenge
  • Conditional access evaluation Policy evaluation during authentication
  • Token refresh Authentication token renewal
operationVersion
String Required

Version of the operation schema

Source: Fixed value

Example 1.0
properties
Object Required

Comprehensive object containing detailed authentication context and metadata

Source: Complex nested object with multiple authentication details

Example {"appDisplayName": "Microsoft Teams", "authenticationMethod": "Password"}
properties.appDisplayName
String Required

Human-readable name of the application being accessed

Source: Random from comprehensive application list

Example Microsoft Teams
properties.authenticationDetails
Array Required

Detailed breakdown of each authentication step performed

Source: Array with primary and optional secondary authentication steps

Example [{"authenticationMethod": "Password", "succeeded": "true"}]
properties.deviceDetail
Object Required

Information about the device used for authentication

Source: Device registry data with compliance and management status

Example {"operatingSystem": "Windows", "isCompliant": true}
properties.location
Object Required

Geographical location details derived from IP address

Source: Structured location data with coordinates

Example {"city": "Seattle", "countryOrRegion": "US", "state": "Washington"}
properties.conditionalAccessStatus
String Required

Result of conditional access policy evaluation

Source: Random from conditional access results

Example success
Values
  • success All applicable policies were satisfied
  • failure One or more policies were not satisfied
  • notApplied No conditional access policies applied
  • unknownFutureValue Reserved for future use
properties.riskLevelAggregated
String Required

Overall risk level assessment for the sign-in

Source: Random from risk levels

Example low
Values
  • none No risk detected
  • low Low risk indicators present
  • medium Medium risk indicators detected
  • high High risk indicators detected
properties.status
Object Required

Authentication result status and error details

Source: Status object with error codes and descriptions

Example {"errorCode": "0", "additionalDetails": "Authentication successful"}
properties.userPrincipalName
String Required

Full user principal name (UPN) of the authenticating user

Source: User email from registry or constructed UPN

Format Email address format
Example john.doe@contoso.com
resourceId
String Required

Azure resource identifier for the tenant and AAD service

Source: Constructed Azure resource path with tenant ID

Example /tenants/12345678-1234-1234-1234-123456789012/providers/Microsoft.aadiam
resultSignature
String Required

High-level result classification

Source: Random from result types

Example Success
Values
  • None No specific result classification
  • Success Authentication succeeded
  • Failure Authentication failed
resultType
String Required

Numeric result code indicating authentication outcome

Source: Random from common Azure AD error codes

Example 0
Values
  • 0 Success
  • 50126 Invalid username or password
  • 50140 Interrupt required for sign-in
  • 50074 Strong authentication required
  • 50076 Strong authentication required (location)
tenantId
String Required

Azure AD tenant identifier

Source: random_guid()

Format UUID
Example 12345678-1234-1234-1234-123456789012