Entra ID sign-in logs: read one record from status to Conditional Access

Where the records live

Entra ID keeps interactive and non-interactive user sign-ins, service principal sign-ins, and managed identity sign-ins as separate streams. The portal keeps them for 30 days on P1 or P2 licences, and 7 on free tenants. Sending them to Log Analytics creates the SigninLogs and AADNonInteractiveUserSignInLogs tables for longer retention and KQL.

The fields that decide most questions

status.errorCode is 0 on success. authenticationRequirement says whether the sign-in needed only one factor or multifactor. conditionalAccessStatus is success, failure, or notApplied, and appliedConditionalAccessPolicies lists each policy’s result. clientAppUsed reveals legacy protocols such as IMAP or Authenticated SMTP, which cannot do MFA.

Get-MgAuditLogSignIn -Filter "userPrincipalName eq 'kim@hackblue-lab.org'" -Top 5 |
  Select-Object CreatedDateTime, AppDisplayName, IPAddress, ClientAppUsed,
    @{n='Error';e={$_.Status.ErrorCode}}, ConditionalAccessStatus, RiskLevelDuringSignIn

CreatedDateTime      AppDisplayName       IPAddress     ClientAppUsed  Error  ConditionalAccessStatus  RiskLevelDuringSignIn
2026-11-02 08:57:12  Office 365 Exchange  198.51.100.9  Browser        0      success                  none
2026-11-02 03:14:40  Office 365 Exchange  203.0.113.77  IMAP4          50126  notApplied               medium

Error codes worth knowing

A few codes cover most reviews. Look up others in Microsoft’s AADSTS error reference rather than guessing.

• 50126: invalid username or password.
• 50053: account locked by smart lockout, or sign-in from a known bad address blocked.
• 50074 and 50076: strong authentication required; the user was challenged for MFA.
• 500121: MFA was attempted and failed or was denied.
• 53003: blocked by a Conditional Access policy.

Worked reading of the 03:14 record

The failed sign-in used IMAP from an address the user has never signed in from, and Conditional Access did not apply. That is the real finding: legacy authentication bypasses the MFA policy because the policy targets modern clients only. The password was wrong this time, but the next guess could be right.

The fix is a Conditional Access policy that blocks legacy authentication clients for all users, first in report-only mode to find mailboxes still using IMAP, then enforced.