Investigating Entra ID sign-in logs: error codes, locations, and password spray patterns

Fields that matter

Each sign-in record includes the user principal name, application, IP address and location, client app, device details, the result code (ResultType), Conditional Access status, authentication requirement, and risk details. Interactive and non-interactive sign-ins are separate log types. Non-interactive sign-ins are token refreshes by apps and are far more numerous.

Result codes you will see often

A ResultType of 0 means success. 50126 means invalid username or password. 50053 means the account is locked, often by Smart Lockout. 50074 and 50076 mean strong authentication was required. 50057 means the account is disabled. 53003 means Conditional Access blocked the sign-in. 500121 means the user failed or abandoned the MFA prompt.

Context matters: a single 50126 is a typo, while 50126 against many accounts from one IP is a spray.

Lab: hunt for a spray in Log Analytics

With sign-in logs exported to a Log Analytics workspace or Microsoft Sentinel, run the query below. A spray looks like one source IP failing against many distinct users with few attempts each, sometimes followed by a single success. Use your own tenant or Microsoft’s sample data in a demo workspace.

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "50126"
| summarize users = dcount(UserPrincipalName), attempts = count(),
            sample = make_set(UserPrincipalName, 5) by IPAddress
| where users > 10
| order by users desc

Following up a hit

For each suspicious IP, check whether any sign-in from it succeeded (ResultType 0), and for those users review MFA results, newly registered authentication methods, and mailbox rules. Then block the IP range with a named location if appropriate, reset affected passwords, and revoke sessions.