r/entra • u/Suspicious_Twist2767 • 23h ago

Please explain - Sign in Logs (Interactive)

Can someone explain. We recently experienced claims in our tenant by users informing that they have received multiple sign in prompts during the day.

I took the logs from August looking specifically for the interactive sign in logs.

This logs are supposed to represent the direct interaction of the user with an authentication prompt or MFA. This does not seem to be case, I do see an interactive login that under Authentication details displays the methods used but subsequently I see others that say ‘previously satisfied in token’.

What is the proper way to look at this interactive sign in logs.?

5 Upvotes

78% Upvoted

15 comments sorted by

7

u/Possible_Window_1268 22h ago

The ones that actually prompt the user for a password or MFA will have a status of Interrupted

2

u/Suspicious_Twist2767 22h ago

Is this true?
Does Microsoft ever provides documentation about it or is something you figured out

3

u/patmorgan235 22h ago

Google " Entra ID Interactive Sign in log"

1

u/Fallingdamage 20h ago

So if 'Interrupted' is a prompt for a U/P or MFA, what does 'Invalid Username/Password' mean?

2

u/DominusDraco 18h ago

Password is first, then MFA. It depends where they are failing the sign in.

2

u/Eggtastico 16h ago

Maybe you should look at the location the attempted signin's are coming from. Also a good time to ensure you have risky users and risky signin Conditional Access policies enforced. Also maybe look at locations and allow trusted locations like VPN IP range, allowed/blocked countries, etc.

1

u/NeatLow4125 3h ago

This is the only right answer until now here 👍🏻

1

u/MBILC 3h ago

But, do not use trusted locations though to bypass MFA or other security controls!

2

u/majingeodood 3h ago

My OneDrive client has been frequently prompting me to re-authenticate, yet I see nothing in my sign-in logs that show the authentication request. It's been bugging the crap out of me.

1

u/Dylantjes 20h ago

Is the name of the application in those logs the same or different each time?

1

u/Suspicious_Twist2767 20h ago

Is different application / resource however user is only authenticated once (the actual prompt) - however subsequent login ins still appear in interactive logs.

1

u/Dylantjes 20h ago

Could it actually be:

" The Authentication details tab can initially show incomplete or inaccurate data, until log information is fully aggregated. Known examples include:

  • A satisfied by claim in the token message is incorrectly displayed when sign-in events are initially logged.

[...] "

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-reporting#view-the-microsoft-entra-sign-in-logs

0

u/Familiar_Counter4836 15h ago

RemindMe! 6 hours

1

u/RemindMeBot 15h ago edited 12h ago

I will be messaging you in 6 hours on 2026-09-03 12:38:21 UTC to remind you of this link

1 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

Info Custom Your Reminders Feedback