entra_list_sign_ins
Retrieve interactive Entra ID sign-in logs with user, device, IP, MFA, and risk details. Filter by user, IP, or error code to quickly investigate authentication issues or security events.
Instructions
List interactive sign-ins from the Entra ID sign-in log: user, application, client and IP address, location, device, conditional access result, MFA detail, risk and error code. Always filter, e.g. "userPrincipalName eq 'alice@contoso.com' and createdDateTime ge 2026-01-01T00:00:00Z", "ipAddress eq '203.0.113.7'", "status/errorCode ne 0". Timestamps are UTC. Requires an Entra ID P1 or P2 licence in the tenant; retention is 30 days.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Maximum number of sign-ins to return (default 25, max 100). | |
| filter | No | OData $filter expression. Refine the filter instead of paging deep. | |
| orderby | No | OData $orderby, e.g. "createdDateTime desc". |