SignIns
Tracks and lists all user sign-in activities for audit and monitoring purposes.
Table Specific Information
Select
Most filters are handled server side, but the specific field of Id will change the endpoint we use to retrieve the data. It must be specified with an '=' or IN condition.
For example:
SELECT * FROM SignIns WHERE Id = '8b0a526e-178d-4494-a276-8819b74d7933'
SELECT * FROM SignIns WHERE Id IN ('8b0a526e-178d-4494-a276-8819b74d7933', 'a8f14261-fb3b-42f7-a27a-d29877b5010b')
SELECT * FROM SignIns WHERE ResourceDisplayName LIKE '%Test%'
Columns
| Name | Type | Description |
| id [KEY] | String | Unique identifier for the sign-in entry. |
| appDisplayName | String | The display name of the application involved in the sign-in event. |
| appId | String | The unique identifier (client ID) of the application involved in the sign-in event. |
| appliedConditionalAccessPolicies | String | List of conditional access policies applied during the sign-in event. |
| clientAppUsed | String | The type of client application (for example, browser, mobile app) used during the sign-in event. |
| conditionalAccessStatus | String | The status of the conditional access policy evaluation during the sign-in event (for example, success, failure). |
| correlationId | String | The unique identifier to correlate this sign-in event with related events for troubleshooting. |
| createdDateTime | Datetime | The date and time when the sign-in event occurred. |
| deviceDetail_browser | String | The browser used on the device during the sign-in event. |
| deviceDetail_deviceId | String | The unique identifier of the device used during the sign-in event. |
| deviceDetail_displayName | String | The display name of the device used during the sign-in event. |
| deviceDetail_isCompliant | Bool | Indicates whether the device used during the sign-in event complies with organizational policies. |
| deviceDetail_isManaged | Bool | Indicates whether the device used during the sign-in event is managed by the organization. |
| deviceDetail_operatingSystem | String | The operating system of the device used during the sign-in event. |
| deviceDetail_trustType | String | The trust type of the device (for example, Azure AD joined, hybrid Azure AD joined). |
| ipAddress | String | The IP address of the client device used during the sign-in event. |
| isInteractive | Bool | Indicates whether the sign-in was initiated interactively by the user. |
| signInLocation_city | String | The city where the sign-in event originated. |
| signInLocation_countryOrRegion | String | The country or region where the sign-in event originated. |
| signInLocation_state | String | The state or province where the sign-in event originated. |
| resourceDisplayName | String | The display name of the resource accessed during the sign-in event. |
| resourceId | String | The unique identifier of the resource accessed during the sign-in event. |
| riskDetail | String | Details about the risk assessment associated with the sign-in event. |
| riskEventTypes | String | The types of risk events detected during the sign-in event. |
| riskEventTypes_v2 | String | A more detailed list of risk events detected during the sign-in event, using an updated schema. |
| riskLevelAggregated | String | The aggregated risk level for the sign-in event (for example, low, medium, high). |
| riskLevelDuringSignIn | String | The assessed risk level during the sign-in event (for example, low, medium, high). |
| riskState | String | The current state of the detected risk (for example, confirmed, dismissed). |
| signInStatus_additionalDetails | String | Additional details about the sign-in status, if available. |
| signInStatus_errorCode | Int | The error code returned for a failed sign-in attempt, if applicable. |
| signInStatus_failureReason | String | A descriptive reason for the failure of the sign-in event, if applicable. |
| userDisplayName | String | The display name of the user who performed the sign-in. |
| userId | String | The unique identifier of the user who performed the sign-in. |
| userPrincipalName | String | The user principal name (UPN) of the user who performed the sign-in, typically in email format. |