Activity history
Northwind Traders · northwindtraders.onmicrosoft.com
Every sign-in and admin change is detailed from 13 Jun 2026.
Up to date as of .
Microsoft keeps 30 days (7 for audit events without Entra ID P1). Office Sentry keeps what it has read for longer, under the retention settings below.
Last 30 days
Sign-ins
1,554
in the last 30 days
Failed
80
5% of sign-ins
Password only
488
37% of successful sign-ins skipped MFA
People
37
signed in at least once
Admin changes to review
8
in the last 30 days
Sign-ins per day
The last 90 days, interactive sign-ins only. Hover over a day for its numbers; sign-ins interrupted by an MFA or other prompt are counted there too.
Sign-ins by month
From the daily summaries. Download a month for every sign-in in it, while it's kept.
| Month | Sign-ins | Failed | Used MFA | People | Every sign-in |
|---|---|---|---|---|---|
| Oct 2026 | 572 | 43 | 66% | 37 | CSV |
| Sep 2026 | 1,664 | 69 | 62% | 33 | CSV |
| Aug 2026 | 1,577 | 62 | 63% | 33 | CSV |
| Jul 2026 | 1,763 | 65 | 61% | 33 | CSV |
| Jun 2026 | 877 | 32 | 60% | 33 | CSV |
Admin changes to review
10Successful changes in the last 90 days worth a second look. Admin activity has every change.
- mediumAdd service principal credentials: Mail Sync Pro 11 Oct 2026, 08:31 UTC by Contoso Automation · Credential added. New secret or certificate: whoever holds it can sign in as the app.
- mediumUpdate application – Certificates and secrets management: Payroll Sync 10 Oct 2026, 08:31 UTC by admin@northwindtraders.example · Added certificate. New secret or certificate: whoever holds it can sign in as the app.
- mediumAdd member to role: robert.hughes@northwindtraders.example 9 Oct 2026, 20:31 UTC by admin@northwindtraders.example · Global Administrator. Admin role granted.
- highSet domain authentication: northwindtraders.example 9 Oct 2026, 08:31 UTC by mallory.price@northwindtraders.example. Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone.
- mediumAdd eligible member to role in PIM completed (permanent): ann.patel@northwindtraders.example 8 Oct 2026, 20:31 UTC by admin@northwindtraders.example · Exchange Administrator. Admin role granted.
- mediumUpdate conditional access policy: Require MFA for all users 6 Oct 2026, 20:31 UTC by admin@northwindtraders.example · On → Off. Conditional Access policy no longer enforced.
- mediumDelete conditional access policy: Block risky countries 5 Oct 2026, 08:31 UTC by admin@northwindtraders.example. Conditional Access policy deleted.
- mediumUpdate application – Certificates and secrets management: Payroll Sync 29 Sep 2026, 20:31 UTC by admin@northwindtraders.example · Added certificate. New secret or certificate: whoever holds it can sign in as the app.
- mediumUpdate conditional access policy: Require MFA for all users 31 Aug 2026, 20:31 UTC by admin@northwindtraders.example · On → Off. Conditional Access policy no longer enforced.
- mediumAdd member to role: robert.hughes@northwindtraders.example 8 Aug 2026, 20:31 UTC by admin@northwindtraders.example · Global Administrator. Admin role granted.
Kept: every sign-in for 180 days, daily sign-in summaries for 25 months and directory audit events for 7 years.