Core Features and Objects of Microsoft 365 Services · Topic 6 of 6
Troubleshooting, Secure Score, Audit and PIM
AB-900 identity operations: sign in log troubleshooting, risky sign ins, Identity Secure Score, audit logs and Privileged Identity Management.
- 5 min
- Sign in logs explain authentication and Conditional Access results. Audit logs record directory changes.
- Risky sign ins and risky users are in Identity Protection.
- Identity Secure Score is a percentage with improvement actions, and not a guarantee.
What it is
Once identity is set up, an administrator needs to keep it healthy. This page covers four everyday tools. Sign in logs and related tools explain why a user could not sign in. Identity Secure Score measures how well identity is configured. Audit logs record who did what. Privileged Identity Management (PIM) controls when admins hold powerful roles.
How it works
Troubleshooting sign in issues
Start in the Microsoft Entra admin center. Open Monitoring and health > Sign in logs and find the failed attempt. Each entry shows the user, the app, the location, the result and the reason for failure.
| Symptom | Where to look |
|---|---|
| The user is asked for MFA, or fails MFA | The sign in log entry shows the authentication details, which methods were used, and whether MFA was satisfied. Also check the user's registered authentication methods |
| Access is blocked or an unexpected prompt appears | The Conditional Access tab on the sign in log entry shows which policies applied and what each one decided. The What If tool tests how policies would apply to a user |
| The sign in was flagged as risky | Protection > Identity Protection > Risky sign ins and Risky users, which show the risk level and the reason |
| Unsure what went wrong | The Diagnose and solve problems area, and the error code in the sign in log |
Risky sign in detections come from Microsoft Entra ID Protection, which needs Entra ID P2 for its full reports and policies. An admin can confirm a user as safe, require a password change or block them.
Identity Secure Score
Identity Secure Score is a percentage in the Microsoft Entra admin center that shows how closely your identity setup follows Microsoft's security recommendations. A higher score means more recommended actions are done.
It lists improvement actions, such as requiring MFA for admins or turning on a Conditional Access policy. Each action shows its potential score gain, and you can mark its status, for example To address, Planned, Risk accepted or Resolved through a third party or alternate mitigation. The score is a guide to what to do next. It is not a guarantee that you are secure.
It is related to, but separate from, Microsoft Secure Score in the Defender portal, which covers your wider security posture, including identity, devices, apps and data.
Reviewing audit logs
Two places record activity, and the exam wants you to pick the right one.
| Tool | What it records | Where |
|---|---|---|
| Microsoft Entra audit logs | Changes in the directory: users created, roles assigned, groups changed, apps added | Entra admin center > Monitoring and health > Audit logs |
| Microsoft Purview Audit | User and admin activity across Microsoft 365 services, such as opening a file in SharePoint, sending mail or changing a Teams setting | Microsoft Purview portal > Audit |
Purview Audit (Standard) keeps records for 180 days by default, and Audit (Premium) keeps them longer. You search by user, activity and date range. Sign in logs show authentication events, while audit logs show configuration and activity changes.
Privileged Identity Management
PIM is a Microsoft Entra ID Governance feature that controls privileged access. Instead of staying a Global Administrator all the time, a person is made eligible for the role and activates it only when needed.
PIM provides:
- Just in time access: the role is active only when needed.
- Time bound access: activation ends automatically after a set period.
- Approval and MFA on activation, with a required reason.
- Notifications and audit history of who activated what and why.
- Access reviews to check whether people still need their roles.
PIM is found in the Entra admin center under Identity governance > Privileged Identity Management and requires Entra ID P2 (or Entra ID Governance).
A worked example
A user reports that she is blocked from the finance app. The admin opens the sign in logs, finds her failed attempt and sees in the Conditional Access tab that a policy requiring a compliant device blocked it. Meanwhile, the security lead notices Identity Secure Score is low and starts with the top action, requiring MFA for admins. To reduce standing admin rights, the team makes four people eligible for the User Administrator role in PIM, with activation limited to four hours.
How the exam asks about this
- "Which tool shows which Conditional Access policy blocked a sign in?" The Entra sign in logs, on the Conditional Access tab.
- "Which feature gives an admin a role only when needed and for a limited time?" Privileged Identity Management.
- "Where do you review who created a user or assigned a role?" The Entra audit logs.
What to remember for the exam
- Sign in logs explain authentication and Conditional Access results. Audit logs record directory changes.
- Risky sign ins and risky users are in Identity Protection.
- Identity Secure Score is a percentage with improvement actions, and not a guarantee.
- Purview Audit covers user and admin activity across Microsoft 365 services.
- PIM makes roles eligible and time bound. It does not remove them from the tenant.
Do not confuse sign in logs with audit logs. A failed sign in is a sign in log. A changed role assignment is an audit log.
Common mistakes
Searching audit logs for a failed sign in. Failed sign ins are in the sign in logs.
Treating Identity Secure Score as a pass or fail grade. It ranks improvements. A high score does not mean no risk.
Thinking PIM gives admins permanent roles. It converts permanent roles into eligible ones that must be activated.
Check yourself
Where do you find which Conditional Access policy affected a sign in?
In the Entra sign in logs, on the Conditional Access tab of the entry, or with the What If tool.
What does Identity Secure Score show?
A percentage that reflects how many recommended identity security actions you have completed, with a list of improvement actions.
What does PIM give an administrator?
Eligible, just in time and time limited access to roles, with approval, MFA and an audit history on activation.
Topic 6 of 6 in Core Features and Objects of Microsoft 365 Services
Test yourself on Core Features and Objects of Microsoft 365 Services
The full Microsoft AB-900 question bank has 499 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.