Auditor | Sign-in & Audit Examiner

Sign in to portal.azure.com
Go to Microsoft Entra ID → App registrations → + New registration
Give it any name (e.g. EntraExaminer)
Supported account types: Accounts in this organizational directory only
Redirect URI → type: Single-page application (SPA) → URI: the URL where this app is hosted
Click Register — copy the Application (client) ID and Directory (tenant) ID into the fields above
Go to API permissions → Add a permission → Microsoft Graph → Delegated permissions and add:
- AuditLog.Read.All (sign-in logs & audit events)
- Directory.Read.All (tenant organisation info)
- User.Read (signed-in user profile)
- IdentityRiskEvent.Read.All (risk detections — requires Azure AD P2)
- IdentityRiskyUser.Read.All (risky users — requires Azure AD P2)
Still in API permissions, also add → Microsoft Graph → Delegated:
- ThreatHunting.Read.All (message trace via Advanced Hunting — requires Microsoft Defender for Office 365 Plan 2)
Click Grant admin consent for [your tenant]

🏠

Sign-in & Audit Examiner

Connect to your tenant and select a date range to begin forensic examination

Overview

Sign-in Logs

Audit Logs

Message Trace

Risk Detections

Risky Users

Date range: →

No data loaded

🔍

No data loaded

Select a date range above and click Fetch Logs to retrieve sign-in and audit data from your tenant.

Tip: Start with 7 days — large date ranges may take several minutes to fetch.

No sign-in data loaded. Use the fetch bar above.

No audit data loaded. Use the fetch bar above.

No message trace data loaded. Select a date range above and click "Fetch Trace". Note: limited to last 10 days.

No risk detection data loaded. Requires Azure AD P2 licence. Click Fetch Logs.

No risky user data loaded. Requires Azure AD P2 licence. Click Fetch Logs.

🔐

Details

—