Activity history
Contoso Legal LLP · contoso.onmicrosoft.com
Every sign-in and admin change is detailed from 14 Jun 2026.
Up to date as of .
Microsoft keeps 30 days (7 for audit events without Entra ID P1). Office Sentry keeps what it has read for longer, under the retention settings below.
Last 30 days
Sign-ins
812
in the last 30 days
Failed
53
7% of sign-ins
Password only
86
12% of successful sign-ins skipped MFA
People
20
signed in at least once
Admin changes to review
8
in the last 30 days
Sign-ins per day
The last 90 days, interactive sign-ins only. Hover over a day for its numbers; sign-ins interrupted by an MFA or other prompt are counted there too.
Sign-ins by month
From the daily summaries. Download a month for every sign-in in it, while it's kept.
| Month | Sign-ins | Failed | Used MFA | People | Every sign-in |
|---|---|---|---|---|---|
| Oct 2026 | 307 | 31 | 89% | 20 | CSV |
| Sep 2026 | 780 | 36 | 88% | 16 | CSV |
| Aug 2026 | 724 | 34 | 88% | 16 | CSV |
| Jul 2026 | 793 | 32 | 88% | 16 | CSV |
| Jun 2026 | 442 | 18 | 87% | 16 | CSV |
Admin changes to review
10Successful changes in the last 90 days worth a second look. Admin activity has every change.
- mediumAdd service principal credentials: Mail Sync Pro 11 Oct 2026, 16:00 UTC by Contoso Automation · Credential added. New secret or certificate: whoever holds it can sign in as the app.
- mediumUpdate application – Certificates and secrets management: Payroll Sync 10 Oct 2026, 16:00 UTC by admin@contoso.example · Added certificate. New secret or certificate: whoever holds it can sign in as the app.
- mediumAdd member to role: bobby.marsh@contoso.example 10 Oct 2026, 04:00 UTC by admin@contoso.example · Global Administrator. Admin role granted.
- highSet domain authentication: contoso.example 9 Oct 2026, 16:00 UTC by mallory.hart@contoso.example. Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone.
- mediumAdd eligible member to role in PIM completed (permanent): annabel.fraser@contoso.example 9 Oct 2026, 04:00 UTC by admin@contoso.example · Exchange Administrator. Admin role granted.
- mediumUpdate conditional access policy: Require MFA for all users 7 Oct 2026, 04:00 UTC by admin@contoso.example · On → Off. Conditional Access policy no longer enforced.
- mediumDelete conditional access policy: Block risky countries 5 Oct 2026, 16:00 UTC by admin@contoso.example. Conditional Access policy deleted.
- mediumUpdate application – Certificates and secrets management: Payroll Sync 30 Sep 2026, 04:00 UTC by admin@contoso.example · Added certificate. New secret or certificate: whoever holds it can sign in as the app.
- mediumUpdate conditional access policy: Require MFA for all users 1 Sep 2026, 04:00 UTC by admin@contoso.example · On → Off. Conditional Access policy no longer enforced.
- mediumAdd member to role: bobby.marsh@contoso.example 9 Aug 2026, 04:00 UTC by admin@contoso.example · Global Administrator. Admin role granted.
Kept: every sign-in for 180 days, daily sign-in summaries for 25 months and directory audit events for 7 years.