Correlation ID
A correlation ID is an identifier used by a system to associate related requests or events so they can be investigated together. Its meaning and reliability depend on the system that records it.
One field for related activity
Microsoft Entra uses correlation IDs to group sign-ins from the same sign-in session. Clients supply the parameters, so Microsoft does not guarantee the value’s accuracy. A matching ID is a useful lead when searching sign-in logs, but it is not proof that two actions came from the same person.
Request IDs and unique token identifiers serve different purposes. Entra documents the request ID as corresponding to an issued token, and the unique token identifier as connecting a token with its request. Use the field that answers your question rather than treating all three as interchangeable tracking numbers.
When records do not join neatly
A help-desk ticket and an application audit log may use entirely different identifiers. Even inside Entra, compare the account, application, resource, time, and outcome alongside the correlation ID. If those details conflict, investigate the conflict rather than forcing the records into one sequence.
An incident timeline can explain how records relate when there is no shared ID. Keep the original records and distinguish a confirmed link from one inferred from timing or context.