Entra: the client app is this sign-in

The value is this attempt’s client

A sign-in can include clientAppUsed, a label such as Browser for the client on that attempt. The label describes this row. A second sign-in can carry a different label.

If the field is empty, write “client app not on this row.” Do not fill it with Browser because that is common.

The account is not the field

The user id is who the directory recorded. The client app is how this attempt was classified. One Browser row does not mean the account has no other clients, and it does not mean a policy about other clients was evaluated.

This page does not add a hunt across the tenant. It only stops one label from being copied onto the account.

What to file

File the sign-in id, the time, and clientAppUsed. If you mention other clients, they need their own rows. Do not write “only” unless the export is the set you mean and you say so.

Worked case: one Browser row read as the account’s only client

Sign-in s-18 for sam@hackblue-lab.org shows clientAppUsed Browser. No other sign-ins were exported. A draft says the account only uses a browser.

The note quotes Browser on s-18. Other clients were not in the export. The word only is removed. The account is not described from one label.

Snippet

sign-in: s-18
account: sam@hackblue-lab.org
clientAppUsed: Browser
other sign-ins exported: none
write: this sign-in used Browser
not: the account only uses a browser

Diagram

Keep the client label on this sign-in

Sign-in id
Which record you are reading.
Id
```
s-18
```
clientAppUsed
The client on that record.
Field
```
Browser
```
Other rows
Not in this export.
Gap
```
do not invent them
```
The account
Not summarized by one label.
Note
```
no “only”
```

Check yourself

1. One sign-in shows clientAppUsed Browser. What does Browser describe?

2. No other sign-ins were exported. What can you say the account never uses?

3. The client field is empty. What do you write?