Sign-in logs
Sign-in logs are records of sign-in activity that help investigators examine the identity, application, target resource, and outcome associated with an authentication attempt.
What a sign-in record can tell you
The available fields and event categories depend on the identity service. Microsoft Entra ID distinguishes interactive user, non-interactive user, service principal, and managed identity sign-ins. A user entering credentials is only one kind of sign-in activity.
Entra sign-in details can include authentication steps and Conditional Access results. Read these fields together to understand the attempt, rather than relying on one policy status or authentication requirement.
What it cannot tell you on its own
A successful sign-in after a password reset is worth investigating. It does not identify the person who called the help desk or prove that someone downloaded a file. Match it to the recovery ticket and directory changes, then check the application records for subsequent activity.
Keep the account, client application, target resource, event category, outcome, and timestamp together when exporting evidence. Record the time zone and search window too. Those details help another investigator reproduce the search without mistaking an authentication event for an application action.