Entra Sign-In log analyzer

Add a sign-in export and press Analyse. The sample export shows every section of the report on fake data.

Interrupts are not failures: MFA prompts (50074, 50076), keep-me-signed-in pauses (50140), and silent sign-in stops (50058) are counted on their own so a noisy MFA rollout does not read as an attack. The built-in table explains the common Entra error codes; anything else is kept and shown raw. The tool cannot compute impossible travel, because that needs Microsoft's own device and location history. A clean result only covers the rows you pasted here.