SignIns
Tracks and lists all user sign-in activities for audit and monitoring purposes.
View-Specific Information
SELECT
Id must be filtered using either the = or IN operator. For example:SELECT * FROM SignIns WHERE Id = '8b0a526e-178d-4494-a276-8819b74d7933'
SELECT * FROM SignIns WHERE Id IN ('8b0a526e-178d-4494-a276-8819b74d7933', 'a8f14261-fb3b-42f7-a27a-d29877b5010b')
SELECT * FROM SignIns WHERE ResourceDisplayName LIKE '%Test%'
Columns
| Name | Type | Description |
| id [KEY] | String | Unique identifier for the sign-in entry. |
| appDisplayName | String | The display name of the application involved in the sign-in event. |
| appId | String | The unique identifier (client ID) of the application involved in the sign-in event. |
| appliedConditionalAccessPolicies | String | List of conditional access policies applied during the sign-in event. |
| clientAppUsed | String | The type of client application (for example, browser, mobile app) used during the sign-in event. |
| conditionalAccessStatus | String | The status of the conditional access policy evaluation during the sign-in event (for example, success, failure). |
| correlationId | String | The unique identifier to correlate this sign-in event with related events for troubleshooting. |
| createdDateTime | Datetime | The date and time when the sign-in event occurred. |
| deviceDetail_browser | String | The browser used on the device during the sign-in event. |
| deviceDetail_deviceId | String | The unique identifier of the device used during the sign-in event. |
| deviceDetail_displayName | String | The display name of the device used during the sign-in event. |
| deviceDetail_isCompliant | Bool | Indicates whether the device used during the sign-in event complies with organizational policies. |
| deviceDetail_isManaged | Bool | Indicates whether the device used during the sign-in event is managed by the organization. |
| deviceDetail_operatingSystem | String | The operating system of the device used during the sign-in event. |
| deviceDetail_trustType | String | The trust type of the device (for example, Microsoft Entra joined, Hybrid Microsoft Entra joined). |
| ipAddress | String | The IP address of the client device used during the sign-in event. |
| isInteractive | Bool | Indicates whether the sign-in was initiated interactively by the user. |
| signInLocation_city | String | The city where the sign-in event originated. |
| signInLocation_countryOrRegion | String | The country or region where the sign-in event originated. |
| signInLocation_state | String | The state or province where the sign-in event originated. |
| resourceDisplayName | String | The display name of the resource accessed during the sign-in event. |
| resourceId | String | The unique identifier of the resource accessed during the sign-in event. |
| riskDetail | String | Details about the risk assessment associated with the sign-in event. |
| riskEventTypes | String | The types of risk events detected during the sign-in event. |
| riskEventTypes_v2 | String | A more detailed list of risk events detected during the sign-in event, using an updated schema. |
| riskLevelAggregated | String | The aggregated risk level for the sign-in event (for example, low, medium, high). |
| riskLevelDuringSignIn | String | The assessed risk level during the sign-in event (for example, low, medium, high). |
| riskState | String | The current state of the detected risk (for example, confirmed, dismissed). |
| signInStatus_additionalDetails | String | Additional details about the sign-in status, if available. |
| signInStatus_errorCode | Int | The error code returned for a failed sign-in attempt, if applicable. |
| signInStatus_failureReason | String | A descriptive reason for the failure of the sign-in event, if applicable. |
| userDisplayName | String | The display name of the user who performed the sign-in. |
| userId | String | The unique identifier of the user who performed the sign-in. |
| userPrincipalName | String | The user principal name (UPN) of the user who performed the sign-in, typically in email format. |