Sign-in logs question

Irin Sultana 372 Reputation points
2024-03-22T22:29:48.2766667+00:00

Hi,

I need to help to understand the sign logs in Microsft Entra admin center. I found some external user activity in sign logs. I am confused how can i know which service is accesiing. How can i verify it's only teams meeting or teams channel or Sharepoint site? Or is there anyway we can find whose internel user send request to that unknown users?

User's image

Thank You!

Irin Sultana

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,131 questions
Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
370 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,314 questions
0 comments
Accepted answer
  1. Fabio Andrade 725 Reputation points Microsoft Employee
    2024-03-27T18:26:19.61+00:00

    @Irin Sultana, the sign in logs will only show you information about user authentication, it won't show each site accessed by the user.

    I'm not a Teams / SharePoint specialist, but I believe yo ucan use Purview to look for the SharePoint audit logs you want.

    https://video2.skills-academy.com/en-us/purview/audit-log-sharing?tabs=microsoft-purview-portal

    Let me know if you have further questions.

    Thanks,

    Fabio

    0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Fabio Andrade 725 Reputation points Microsoft Employee
    2024-03-22T23:01:33.0233333+00:00

    Hi @Irin Sultana, Thanks for reaching out to Microsoft Q&A!

    Inside each sign in log event, you have the option to expand and check for the details about the sign in just like shown in the link below

    https://video2.skills-academy.com/en-us/entra/identity/monitoring-health/concept-sign-in-log-activity-details

    If you do not recognize the guest user that is signing in to your applications, I strongly recommend you to block the user while you investigate it further.

    Let me know if you have any more questions.

    Thanks,

    Fabio

    0 comments
  2. Fabio Andrade 725 Reputation points Microsoft Employee
    2024-03-26T23:27:06.4233333+00:00

    Hi @Irin Sultana

    I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

    If you have any other questions, please let me know.

    Thanks,

    Fabio

  3. Fabio Andrade 725 Reputation points Microsoft Employee
    2024-04-03T22:53:15.1133333+00:00

    Hi @Irin Sultana

    I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

    If you have any other questions, please let me know.

    Thanks,

    Fabio