Entra: what one sign-in row can say about user, app, and place

The account is the directory object on the row

userPrincipalName and the user id are the account Entra recorded for this sign-in. That is who the directory authenticated, or tried to. It is not a photograph of a person, and it is not proof that the owner of the account was the one at a keyboard. If you need that, you need something outside this row, such as a conversation with the owner, cited as its own source.

A failed row is still about that account. It does not become a different user because the city looks unfamiliar.

The app and the resource are the names on the row

appDisplayName is the application in the sign-in. resourceDisplayName, when it is present, is the resource the application was reaching. Quote whichever fields the row actually has. A sign-in to a mail or chat application does not list messages read, files opened, or mailboxes searched. Those are workload logs, not this row.

The application id is the stable identifier when two apps share a display name. If the row has it, copy it next to the display name.

The IP is observed; the city is attached

ipAddress is the address Entra saw for the sign-in. location.city and the country are a lookup on that address. A corporate proxy, a VPN exit, or a mobile carrier can make the city the exit’s city. Write the IP as the address, and write the city as lookup text. Do not write that the person traveled there.

deviceDetail is what the client reported about the device. Treat it as a reported label, the same way you would a browser string, unless you have a device record you can join and you say that you joined it.

Worked case: Dublin on a lab-office sign-in

A successful row at 2026-11-03T16:40:22Z shows riley@hackblue-lab.org, application Microsoft Teams, resource Microsoft Teams, IP 203.0.113.10, and city Dublin. Riley was in the lab office. The office traffic leaves through a proxy whose address looks up as Dublin.

The note says: successful sign-in for that account to that application, from 203.0.113.10, at that time. City Dublin is lookup text on the IP. The row does not say Riley was in Dublin, and it does not list any chat that was opened. A sentence about travel would need a source other than this lookup.

Snippet

time: 2026-11-03T16:40:22Z
user: riley@hackblue-lab.org
app: Microsoft Teams
resource: Microsoft Teams
ip: 203.0.113.10
city: Dublin (lookup on the IP, not a travel claim)
result: success

Diagram

Three claims, three fields

Account
Who the directory recorded.
Field
```
userPrincipalName
```
App
Which application the sign-in names.
Field
```
appDisplayName, and resource if present
```
Address
The IP Entra saw.
Field
```
ipAddress
```
Lookup
City and country, labeled as a lookup.
Not travel
```
location.city
```

Check yourself

1. Which field is the account Entra recorded for the sign-in?

2. A row names a chat application. What does that prove?

3. The city says Dublin and the user was in the lab office. What is the city?