how to read entra sign-in logs to trace a failed login

TL;DR

Open Entra admin center > Monitoring and health > Sign-in logs, filter by the user's UPN and the time window, and click the failed event. The status tab shows the error code; click it for the remediation steps. One failed sign-in record with its error code beats ten guesses from the user.

Steps

1. Get the user's UPN (their full work email), the approximate time of the failure, and a correlation ID if they saw one on the error screen. Expected: enough detail to filter precisely.
2. Go to Entra admin center > Identity > Monitoring and health > Sign-in logs. Expected: the log blade loads. Sign-in logs need Entra ID P1 minimum, and interactive sign-ins retain 30 days.
3. Add filters: User = the UPN, Status = Failure, Date = the reported window. Expected: a short list of failed sign-ins instead of thousands of rows.
4. Click the failed event and read the Basic info and status tabs. Expected: the error code (for example 50053 account locked, 50057 disabled account, 50126 bad credentials), plus IP, location, device, and which Conditional Access policies were evaluated.
5. Click the error code link or look it up in Microsoft's AADSTS error reference. Expected: a concrete remediation step instead of a guess.
6. Apply the fix (unlock the account, adjust the CA policy, reset the password) and have the user retry; re-check the logs for a success event. Expected: a new entry with status Success.

Use this when

• A user cannot sign in and you need the real failure reason
• You suspect Conditional Access, MFA, or account state is the cause
• Escalating to tier 2 and want the evidence attached to the ticket

Not for this skill when

• The problem is app provisioning or SCIM sync (use provisioning logs, not sign-in logs)
• You need to know who changed a setting (that is the audit log)
• Non-interactive service failures with no user context (check service principal sign-ins separately)

Compatibility

• Microsoft Entra ID P1 or higher for sign-in logs; admin center or Microsoft Graph API

Variants

Too many rows to find the failure

Filter by the correlation ID or request ID from the user's error screen; it pins the exact event.

User says "it worked yesterday"

Compare yesterday's successful event with today's failure. The diff (new IP, new CA policy evaluation, device change) is usually the cause.

Why it happens

The sign-in pipeline evaluates credentials, account state, MFA, Conditional Access, and device compliance in sequence, and the log records where it stopped. Reading the log backward from the failure point is faster than checking each system, because the log already did that work.

Edge cases

• Sign-in logs have a short delay; events can take a few minutes to appear.
• B2B guests appear under their guest UPN, not their home email; search for both.
• Some failures never reach Entra (DNS, network, client certificate issues); an empty log for the time window means the request never arrived.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uMJVZaPxolYorD2Ondfx1Q

Resolved from the public thread: https://vectle.com/posts/pst_uMJVZaPxolYorD2Ondfx1Q

Thread query: how to read entra sign-in logs to trace a failed login

TL;DR: Open Entra admin center > Monitoring and health > Sign-in logs, filter by the user's UPN and the time window, and click the failed event. The status tab shows the error code; click it for the remediation steps. One failed sign-in record with its error code beats ten guesses from the user.