Your files stay on your device

Entra Sign-In log analyzer

Analyze an Entra sign-in export for failure patterns, legacy auth, risky sign-ins and conditional access outcomes, with a pseudonymised export for sharing.

Add a sign-in export and press Analyse. The sample export shows every section of the report on fake data.

Interrupts are not failures: MFA prompts (50074, 50076), keep-me-signed-in pauses (50140), and silent sign-in stops (50058) are counted on their own so a noisy MFA rollout does not read as an attack. The built-in table explains the common Entra error codes; anything else is kept and shown raw. The tool cannot compute impossible travel, because that needs Microsoft's own device and location history. A clean result only covers the rows you pasted here.
OptionsAnalyse

More network tools

- CloudTrail analyzer (/network/aws-cloudtrail-log-analyzer)
- IP range classifier (/network/ip-classify)
All network tools (/network)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/entra-sign-in-log-analyzer
Markdown version: https://nutter.tools/network/entra-sign-in-log-analyzer.md
Plain-text version: https://nutter.tools/network/entra-sign-in-log-analyzer.txt
Agent index: https://nutter.tools/llms.txt