Entra Sign-In Log Analyzer

Analyse Microsoft Entra sign-in exports for failure patterns, applications, locations, devices and conditional-access outcomes, with personal fields redactable before you share.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop an Entra sign-in export

CSV or JSON from Entra admin center > Sign-in logs > Download, a Graph /auditLogs/signIns response, or Log Analytics SigninLogs exported as JSON/CSV.

Or paste the export

Sign-ins, explained code by code

Entra records every sign-in with an error code, and the codes say far more than "failed". The analyzer:

separates real failures from interrupts, such as an MFA prompt (50074/50076), a keep-me-signed-in question (50140) or a silent sign-in with no session (50058);
names each code in plain words: 50126 is a wrong password, 50053 is smart lockout, 53003 is a Conditional Access block;
breaks sign-ins down by application, country, client app, operating system and Conditional Access result.

What it points at

Legacy authentication: IMAP, POP, SMTP AUTH, Exchange ActiveSync and "other clients" cannot perform MFA. A successful legacy sign-in is raised as high.
Risky sign-ins: sign-ins that Identity Protection rated medium or high, with their risk state.
Smart lockout and Conditional Access blocks, as context: these are controls working, and often a user who needs help.

For password spraying, first-seen countries and impossible travel, send the same export to the Authentication Anomaly Analyzer, which has adjustable thresholds.

Redact before you share

Sign-in logs are personal data. The redacted export replaces each user principal name, display name and IP address with a stable pseudonym (user-1, ip-1). The same person keeps the same label throughout, so patterns survive. Coordinates are rounded to whole degrees and cities are removed. The mapping is never written anywhere.

Frequently asked questions

Does this need access to my tenant?

No. It never signs in to Microsoft and asks for no permissions - it reads the file you exported, in your browser.

Why is an MFA prompt not counted as a failure?

Because it is not one: 50074 means "strong authentication required" and is normally followed by a success. Counting interrupts as failures inflates numbers and hides real ones.

The portal CSV has several files - which one?

Use the interactive (or non-interactive) sign-ins file. The authentication details file has a different shape.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.