Auditor | Sign-in & Audit Examiner

Sign in to portal.azure.com
Go to Microsoft Entra ID → App registrations → + New registration
Give it any name (e.g. EntraExaminer)
Supported account types: Accounts in this organizational directory only
Redirect URI → type: Single-page application (SPA) → URI: the URL where this app is hosted
Click Register — copy the Application (client) ID and Directory (tenant) ID into the fields above
Go to API permissions → Add a permission → Microsoft Graph → Delegated permissions and add:
- AuditLog.Read.All (sign-in logs & audit events)
- Directory.Read.All (tenant organisation info)
- User.Read (signed-in user profile)
- IdentityRiskEvent.Read.All (risk detections — requires Azure AD P2)
- IdentityRiskyUser.Read.All (risky users — requires Azure AD P2)
Still in API permissions, also add → Microsoft Graph → Delegated:
- ThreatHunting.Read.All (post-delivery event details — requires Microsoft Defender for Office 365 Plan 2)
Click Grant admin consent for [your tenant]

🏠

Sign-in & Audit Examiner

Connect to your tenant and select a date range to begin forensic examination

Overview

Sign-in Logs

Audit Logs

Message Trace

Risk Detections

Risky Users

Date range: →

No data loaded

🔍

No data loaded

Select a date range above and click Fetch Logs to retrieve sign-in and audit data from your tenant.

Tip: Start with 7 days — large date ranges may take several minutes to fetch.

No sign-in data loaded. Use the fetch bar above.

No audit data loaded. Use the fetch bar above.

No message trace data loaded. Select a date range and click "Fetch Trace". Uses Exchange Reporting Service — requires ReportingWebService.Read.All consent.

No risk detection data loaded. Requires Azure AD P2 licence. Click Fetch Logs.

No risky user data loaded. Requires Azure AD P2 licence. Click Fetch Logs.

🔐

Details

—