Inspect a sign-in export locally

Draft for review

Source review: September 15, 2026. Tenant validation pending.

Page tools and document details

Start here

Check the evidence before interpreting the event

This local tool summarizes an existing sign-in JSON export. It helps find missing timestamps, repeated IDs and unfinished Graph pages. It does not connect to a tenant or decide whether an account is safe.

Keep the originalWork from a copy in your approved evidence location. Record who collected it and when.
Record the collection scopeNote the tenant, selected user or workload, source tab, export filters and time range. The file cannot prove these settings by itself.
Try the synthetic example firstIt has three invented rows: code 50076, code 0 and an unknown result. Check that those outcomes remain separate.

Collect the right file

An authorized Reports Reader can use Entra ID → Monitoring & health → Sign-in logs → Download → JSON. Select the required log types separately. Preserve full interactive and non-interactive exports for a user investigation; authentication-details-only files serve a different purpose.

The portal download is available across Entra editions. Graph download requires the applicable premium license and role. Existing retention and filters limit what can be exported; this tool cannot recover missing history.

Use a full UTF-8 JSON array or a Graph object with a value array. The inspector supports up to 10 MiB and 100,000 rows. Narrow an oversized export and document the new scope. Keep CSV originals if already collected; obtain a supported JSON export for this tool.

Inspect a local export

The interactive inspector loads with JavaScript. You can still follow the manual checks below.

Resolve an evidence gap

Unfinished Graph page: complete the authorized export through your collection process. This tool deliberately does not follow a next-page URL.
Missing timestamps or results: check whether you selected a partial projection or authentication-details-only file. Obtain the full event export when available.
Repeated IDs: compare the original rows. They may overlap or contain differing detail; do not silently delete them from evidence.
No matching rows: recheck the filter, UTC offset, source tab and retention. Record an unresolved gap if the required window is unavailable.

A code 0 row records a successful sign-in, including one an attacker could have completed. A nonzero result can reflect a legitimate MFA interruption. Use the MFA guide for an expected 50076 challenge or Suspicious Sign-ins to investigate unrecognized activity.

Verify the summary against its source

Reconcile the countsCompare the total rows, unsupported rows and selected range with the original. Counts remain rows, including repeated IDs.
Spot-check exact eventsCompare a success, a nonzero result and any unknown result with the original event fields. A preview shows only the first 50 selected rows.
Retain the hash and coverage notesThe SHA-256 identifies the exact selected file bytes. It proves neither source authenticity nor complete collection. Clear the page after saving the summary where approved.

The inspector has synthetic fixture and local browser tests. Compatibility with a real tenant export remains to be validated. If a result conflicts with the original, retain both and stop relying on this summary until reviewed.

Hand over coverage, not a guessed verdict

Copy or download the inspector's summary. It excludes identity fields, while retaining times and a file hash. Review it before external sharing. Agree a secure evidence channel before sending original logs.

Question being investigated:
Export source and filter scope (redacted):
Collection time and UTC offset:
Original file hash:
Observed window and counts:
Missing coverage or conflicting rows:
Manual spot-check result:
Next evidence step and owner:

Discuss an evidence gap

Sources and interpretation

Download Entra logs Microsoft Graph sign-in fields Entra data retention

Observed event span means the first and last valid timestamps in the selection. It is not a guarantee of continuous coverage. The tool reports file observations and performs no remediation or risk classification.