Inspect a sign-in export locally

Draft for review

Source review: September 29, 2026. Tenant validation pending.

Page tools and document details

Start here

Check the evidence before interpreting the event

This local tool summarizes an existing sign-in JSON export. It helps find missing timestamps, repeated IDs and unfinished Graph pages. It does not connect to a tenant or decide whether an account is safe.

Keep the originalWork from a copy in your approved evidence location. Record who collected it and when.
Record the collection scopeNote the tenant, selected user or workload, source tab, export filters and time range. The file cannot prove these settings by itself.
Try the synthetic example firstIt has three invented rows: code 50076, code 0 and an unknown result. Check that those outcomes remain separate.

Collect the right file

An authorized Reports Reader can use Entra ID → Monitoring & health → Sign-in logs → Download → JSON. Select the required log types separately. Preserve full interactive and non-interactive exports for a user investigation; authentication-details-only files serve a different purpose.

The portal download is available across Entra editions. Graph download requires the applicable premium license and role. Existing retention and filters limit what can be exported; this tool cannot recover missing history.

Use a full UTF-8 JSON array or a Graph object with a value array. The inspector supports up to 10 MiB and 100,000 rows. Narrow an oversized export and document the new scope. Keep CSV originals if already collected; obtain a supported JSON export for this tool.

Inspect a local export

The interactive inspector loads with JavaScript. You can still follow the manual checks below.

A supported JSON example and a check you can repeat

This invented two-row array matches the fields the inspector reads. Save it as a UTF-8 .json file and select it above. A Graph response wrapping the array in {"value": [...]} is also supported. Do not paste browser tokens or an entire HAR into the tool.

[
  {
    "id": "example-1",
    "createdDateTime": "2026-09-29T08:00:00Z",
    "appDisplayName": "Example app",
    "isInteractive": true,
    "status": {
      "errorCode": 50076
    }
  },
  {
    "id": "example-2",
    "createdDateTime": "2026-09-29T08:05:00Z",
    "appDisplayName": "Example app",
    "isInteractive": true,
    "status": {
      "errorCode": 0
    }
  }
]

With no time filter, expect two rows, one zero result and one nonzero result. With start 2026-09-29T08:00:00Z and end 2026-09-29T08:05:00Z, expect only the 50076 row. The start is included and the end is excluded. A missing or invalid timestamp cannot be placed into a selected window.

The tool’s built-in sample is separate and has three rows. Its expected result remains one zero, one nonzero and one unknown result. “Nonzero” does not automatically mean malicious, and “zero” does not prove the user initiated the event.

Resolve an evidence gap

Unfinished Graph page: complete the authorized export through your collection process. This tool deliberately does not follow a next-page URL.
Missing timestamps or results: check whether you selected a partial projection or authentication-details-only file. Obtain the full event export when available.
Repeated IDs: compare the original rows. They may overlap or contain differing detail; do not silently delete them from evidence.
No matching rows: recheck the filter, UTC offset, source tab and retention. Record an unresolved gap if the required window is unavailable.

A code 0 row records a successful sign-in, including one an attacker could have completed. A nonzero result can reflect a legitimate MFA interruption. Use the MFA guide for an expected 50076 challenge or Suspicious Sign-ins to investigate unrecognized activity.

From download to a useful handoff

Record the selected tenant, user, log tab, filters and collection time before downloading. Portal exports use UTC and can contain up to 100,000 sign-in rows. Reaching that count is a reason to check completeness, not proof that you captured everything.
Collect interactive and non-interactive user logs separately. In this page select a local file, check any coverage warnings, then apply an explicit UTC interval if needed. The preview is limited to 50 rows, while summary counts cover the full selected set.
A @odata.nextLink warns that more pages exist. The inspector will not fetch it. Complete collection using an authorized tool and preserve the original page files. The read-only overview in Suspicious Sign-ins flattens selected fields and is not a full JSON export for this inspector.
Review the report before copying or downloading. Analysis stays in page memory and the file is not uploaded. The summary omits identity fields but retains time ranges and the file hash. Keep it in approved evidence storage and clear the page when finished.

Microsoft: Download logs · Microsoft Graph: List signIns

Verify the summary against its source

Reconcile the countsCompare the total rows, unsupported rows and selected range with the original. Counts remain rows, including repeated IDs.
Spot-check exact eventsCompare a success, a nonzero result and any unknown result with the original event fields. A preview shows only the first 50 selected rows.
Retain the hash and coverage notesThe SHA-256 identifies the exact selected file bytes. It proves neither source authenticity nor complete collection. Clear the page after saving the summary where approved.

The inspector has synthetic fixture and local browser tests. Compatibility with a real tenant export remains to be validated. If a result conflicts with the original, retain both and stop relying on this summary until reviewed.

Hand over coverage, not a guessed verdict

Copy or download the inspector's summary. It excludes identity fields, while retaining times and a file hash. Review it before external sharing. Agree a secure evidence channel before sending original logs.

Question being investigated:
Export source and filter scope (redacted):
Collection time and UTC offset:
Original file hash:
Observed window and counts:
Missing coverage or conflicting rows:
Manual spot-check result:
Next evidence step and owner:

Discuss an evidence gap

Sources and interpretation

Download Entra logs Microsoft Graph sign-in fields Entra data retention

Observed event span means the first and last valid timestamps in the selection. It is not a guarantee of continuous coverage. The tool reports file observations and performs no remediation or risk classification.