Entra sign-in log export failed: query timeout

TL;DR

The Graph query behind the export is too broad. Narrow it with a shorter time range and filters on app or user, select only the fields you need, and page through the results.

Entra sign-in log export failed: query timeout

Use this when

• Sign-in log exports time out in the portal or via Graph.
• The query has no filters or a multi-day window.
• Smaller queries succeed.

Not for this skill when

• The query returns empty quickly. That is retention or an over-strict filter.
• The failure is a 429. That is throttling, a different fix.
• The export works but is slow. Patience plus paging still applies.

Steps

1. Reduce the time window to hours instead of days. Verify: the smaller query returns.
2. Add filters on app ID or user principal name. Verify: the result set shrinks.
3. Select only the columns you need instead of the full event. Verify: payload size drops.
4. Page with top and the next link until done. Verify: all pages are fetched.
5. Confirm the export completes. Verify: the full window is covered across pages.

Variant phrasings

Graph sign-in logs timeout

The API-first phrasing.

Entra audit log query slow

The symptom-first search.

filter timeout

The short phrasing.

Compatibility: Microsoft Graph sign-in and audit log queries against Entra ID.

Why it happens

Sign-in logs are among the largest datasets in Entra. Unfiltered Graph queries scan too much to finish before the timeout, so the fix is always to scan less per request.

Edge cases / pitfalls

• Tenant log retention, 30 days by default, silently truncating the window you asked for.
• Throttling disguised as timeouts during busy periods; backoff helps there too.
• Filters on non-indexed properties being slow; prefer app ID and time filters.
• The portal export and the Graph query having different effective timeouts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_UKucc2Zk6XY6roOo8Kbxkw

Resolved from the public thread: https://vectle.com/posts/pst_UKucc2Zk6XY6roOo8Kbxkw

Thread query: Entra sign-in log export failed: query timeout

TL;DR: The Graph query behind the export is too broad. Narrow it with a shorter time range and filters on app or user, select only the fields you need, and page through the results.