Entra Sign-in Log Analyzer

Inspect exported sign-in events, failure clusters, correlation IDs, and authentication steps without contacting a tenant.

Identifiers are masked in generated summaries and exports. This is an export analyzer, not a live sign-in or Conditional Access decision engine.

Sign-in exportJSON or CSV

[
  {
    "createdDateTime": "2026-01-15T10:00:00Z",
    "userPrincipalName": "jane@example.test",
    "appDisplayName": "Fictional Reports",
    "correlationId": "corr-100",
    "status": {
      "errorCode": 0
    },
    "conditionalAccessStatus": "success",
    "authenticationRequirement": "multiFactorAuthentication",
    "authenticationDetails": [
      {
        "authenticationMethod": "FIDO2"
      }
    ]
  },
  {
    "createdDateTime": "2026-01-15T10:02:00Z",
    "userPrincipalName": "jane@example.test",
    "appDisplayName": "Fictional Reports",
    "correlationId": "corr-100",
    "status": {
      "errorCode": 50076,
      "failureReason": "Additional authentication required"
    },
    "conditionalAccessStatus": "failure",
    "authenticationRequirement": "multiFactorAuthentication"
  }
]

Events2

Failures1

MFA events1

Correlation clusters1

Masked analysisIdentifiers are redacted in this view

{
  "summary": {
    "eventCount": 2,
    "failureCount": 1,
    "correlationClusters": 1,
    "mfaEvents": 1,
    "maskedIdentifiers": true
  },
  "rows": [
    {
      "index": 0,
      "createdDateTime": "2026-01-15T10:00:00Z",
      "user": "j***@example.test",
      "app": "Fictional Reports",
      "correlationId": "co***00",
      "statusCode": "0",
      "failureReason": "",
      "conditionalAccessStatus": "success",
      "authenticationRequirement": "multiFactorAuthentication",
      "mfaSteps": 1
    },
    {
      "index": 1,
      "createdDateTime": "2026-01-15T10:02:00Z",
      "user": "j***@example.test",
      "app": "Fictional Reports",
      "correlationId": "co***00",
      "statusCode": "50076",
      "failureReason": "Additional authentication required",
      "conditionalAccessStatus": "failure",
      "authenticationRequirement": "multiFactorAuthentication",
      "mfaSteps": 0
    }
  ]
}