Monitoring with Logs, Workbooks and Identity Secure Score

What it is

You cannot secure what you cannot see. Microsoft Entra records what happens in your tenant in several logs. You read them in the admin center, send them to Azure Monitor to keep them longer and query them with Kusto Query Language (KQL), and visualise them in workbooks. Identity Secure Score measures your identity security posture and suggests what to improve.

How it works

The main logs

The four sign in tabs matter. Interactive sign ins are where the user types credentials or approves MFA. Non interactive sign ins are done by a client for the user, such as a mobile mail app refreshing tokens in the background. Service principal and managed identity sign ins are for workloads.

Retention

Logs shown in the admin center are kept only briefly.

To keep logs longer, or to analyse them with other data, export them with diagnostic settings. Entra ID P1 or P2 is needed to export sign in logs.

Diagnostic settings

A diagnostic setting sends the logs you choose to one or more destinations.

Create the setting under Diagnostic settings in the Entra admin center, choose the categories such as SignInLogs, AuditLogs and NonInteractiveUserSignInLogs, and pick the destination.

Querying with KQL

In a Log Analytics workspace, the Entra logs are tables. Common ones are SigninLogs, AuditLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs and AADManagedIdentitySignInLogs.

SigninLogs
| where TimeGenerated > ago(7d) and ResultType != 0
| summarize Failures = count() by UserPrincipalName
| order by Failures desc

AuditLogs
| where OperationName has "role"
| project TimeGenerated, OperationName, InitiatedBy, TargetResources

The first query lists users with the most failed sign ins. The second shows role related changes and who made them. To find out who added a client secret to an app, search the audit logs for the app's credential change.

Workbooks and reports

Workbooks are interactive reports built on the log data. Entra ID includes templates, such as the Conditional Access insights and reporting workbook, which shows the effect of each policy over time, and workbooks on sign in activity, authentication methods and risk. You can edit a template or build your own. The admin center also has built in reports, such as authentication methods activity, risky users and usage.

Identity Secure Score

Identity Secure Score is a percentage that shows how well your tenant follows identity security best practices. It lists improvement actions, such as requiring MFA for administrators, blocking legacy authentication or reducing the number of Global Administrators, each with its impact on the score and the steps to complete it. As you finish the actions, the score rises, and you can compare it with similar organisations.

Who can view what

Choose the narrowest role. An external auditor who must read nearly all settings across workloads fits Global Reader.

Choosing the tool

A worked scenario

A security team needs to keep identity logs for a year and run queries on them. It creates a diagnostic setting that sends the audit, sign in, non interactive and service principal logs to a Log Analytics workspace, and also archives them to a storage account. A KQL query reports failed sign ins by user. When a suspicious change appears, an analyst checks the audit logs to see who added a client secret and when. The team uses the Conditional Access insights workbook to review policy results, and works through the Identity Secure Score actions each month.