Defender-EntraIdSignInEvents

ActionTypeTitleSampleRule
anyEntra ID user sign-inYN

any: Entra ID user sign-in

#
Table
EntraIdSignInEvents

Example Event #

{
  "AccountDisplayName": "Admin User",
  "AccountObjectId": "11111111-1111-1111-1111-111111111111",
  "AccountUpn": "adminuser@example.onmicrosoft.com",
  "Application": "dwh-ah-collector",
  "ApplicationId": "7a5f4796-9012-4dad-a525-8427af2d12c5",
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationRequirement": "multiFactorAuthentication",
  "Browser": "Firefox 153.0",
  "City": "Redacted",
  "ClientAppUsed": "Mobile Apps and Desktop clients",
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0,
      "includeRulesSatisfied": [
        {
          "conditionalAccessCondition": 1,
          "ruleSatisfied": "allApps"
        },
        {
          "conditionalAccessCondition": 2,
          "ruleSatisfied": "allUsers"
        }
      ]
    }
  ],
  "ConditionalAccessStatus": 2,
  "CorrelationId": "eb8d8c1e-20d7-4443-85bf-0296a2fc293e",
  "Country": "US",
  "EndpointCall": "Login:reprocess",
  "ErrorCode": 50199,
  "GatewayJA4": "t13d1617h2_86a278354501_e6dcd7ae0a9e",
  "IPAddress": "203.0.113.10",
  "IsCompliant": 0,
  "IsExternalUser": 0,
  "IsGuestUser": 0,
  "IsGuestUser@odata.type": "#SByte",
  "IsManaged": 0,
  "LastPasswordChangeTimestamp": "2026-01-17T02:18:03Z",
  "Latitude": "0.0",
  "LogonType": [
    "interactiveUser"
  ],
  "Longitude": "0.0",
  "NetworkLocationDetails": [],
  "ReportId": "bd6e2a72-2924-437d-91ae-a4d76408331a",
  "RequestId": "bb9195ba-03e1-4a71-a145-a5c9721a2100",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceId": "00000003-0000-0000-c000-000000000000",
  "ResourceTenantId": "00000000-0000-0000-0000-000000000001",
  "RiskLevelAggregated": 0,
  "RiskState": 0,
  "SessionId": "006ea83a-2932-54d9-1731-544dd799b8f0",
  "State": "Redacted",
  "Timestamp": "2026-08-01T16:34:45.2489632Z",
  "TokenIssuerType": "0",
  "UniqueTokenId": "upWRu-EDcUqhRaXJchohAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0"
}

References #