How to Investigate Risky Sign-ins in Microsoft Entra ID

What Counts as a Suspicious Sign-In in Microsoft Entra ID?

Microsoft Entra ID Protection evaluates sign-ins against a set of risk signals, including:

1. Anonymous IP Address: Logins originating from IP addresses related to anonymizing proxy servers, virtual private networks (VPNs) used to hide a login’s identity, or Tor exit nodes.
2. Impossible Travel: A user signs in from two geographically distant locations within a timeframe that makes legitimate travel impossible.
3. Leaked Credentials: Microsoft detects that the user’s credentials have been exposed in known credential leak datasets.
4. Password Spray Activity: Repeated attempts to authenticate to multiple accounts using commonly used passwords.
5. Malicious IP Address: IPs previously linked to high volumes of failed authentication attempts.

Native Methods to Investigate Suspicious Sign-Ins in Microsoft Entra ID

Microsoft Entra ID provides two native methods for investigating Microsoft 365 sign-in activity: the Microsoft Entra Admin Center and PowerShell.

Method 1: Using the Microsoft Entra Admin Center

The Microsoft Entra Admin Center provides the quickest way to review sign-in activity and identity risk information, making it the first place administrators typically investigate suspicious authentication events.

Permissions Required: Appropriate Microsoft Entra role (such as Security Reader or Security Administrator) and Microsoft Graph permissions (for example, AuditLog.Read.All and, where applicable, IdentityRiskyUser.Read.All or IdentityRiskEvent.Read.All).

Steps to Investigate Suspicious Sign-In Activity:

1. Sign in to the Microsoft Entra Admin Center
2. Navigate to Identity > Monitoring & Health > Sign-In logs to view every sign-in attempt, including its status, IP address, location, device, and application used.
3. For risk-specific data, go to Identity > Protection > Risky users to see full details, such as IP address, location, device, application, Conditional Access Status, and the exact risk detection that triggered the flag.
4. Act based on what you find:
   • Confirm Compromised: Select this option if the sign-in was not performed by the legitimate account owner. This confirms the account has been compromised and updates Microsoft Entra ID’s risk assessment.
   • Confirm Safe: Select this option if the sign-in was legitimate. This mitigates the associated risk and helps improve Microsoft’s future risk-detection accuracy.
5. From the Risky users report, you can also reset the password, block sign-in, or dismiss user risk, depending on your findings.

Method 2: Using PowerShell

For administrators who prefer scripting, need to automate investigations, or want to integrate sign-in data with external tools such as SIEM platforms, the Microsoft Graph PowerShell SDK offers a faster, more flexible approach.

Permissions Required: Global Administrator, Security Administrator, Security Reader, Global Reader, or Reports Reader (with the appropriate Microsoft Graph API permissions).

Steps to Investigate Suspicious Sign-In Activity

1. Install and Connect to Microsoft Graph: Install the required Microsoft Graph PowerShell modules and connect to Microsoft Graph.
2. Retrieve Sign-In Logs: Retrieve risky sign-in data using the Microsoft Graph Identity Protection API (for example, Get-MgRiskyIdentityProtectionRiskySignIn)
3. Retrieve Risky Sign-In: Retrieve risky sign-in logs to view sign-in events that Microsoft Entra ID has identified as potentially risky. These logs include risk detections and help investigators identify suspicious authentication attempts, such as sign-ins from unfamiliar locations, anonymous IP addresses, or other indicators of compromise.

How Lepide Helps You Investigate Suspicious Sign-Ins Faster

While Microsoft Entra ID Protection identifies risky sign-ins, security teams often need additional context to determine whether an event represents a genuine threat or legitimate user activity. Lepide Entra ID Auditor simplifies this investigation by presenting successful and failed sign-ins in searchable, centralized reports that capture the who, what, when, and where of every authentication event.

Using Lepide, administrators can quickly review sign-in activity, identify failed login attempts, view the originating IP address, and filter authentication events by user, time period, operation, or criticality. This makes it easier to investigate suspicious sign-ins without manually searching through multiple native audit logs.

With Lepide, organizations can:

• View successful and failed sign-in events in centralized, searchable reports.
• Filter authentication events by user, date, operation, IP address, and criticality to accelerate investigations.
• Receive real-time alerts for suspicious authentication activity.
• Search historical sign-in data to support incident response and forensic investigations.
• Generate compliance-ready reports for security audits and post-incident reviews.
• Correlate suspicious sign-ins with identity changes, privilege modifications, and other Microsoft Entra ID audit events for additional investigation context.

Beyond sign-in investigations, Lepide also provides comprehensive auditing for Microsoft Entra ID, enabling organizations to monitor user and group changes, role assignments, administrative activities, and other identity events from a single console.

Frequently Asked Questions