Home › Free tools › Microsoft 365 sign-in check
Drop in your Entra ID sign-in log. It finds mailboxes still signing in the old way that skips MFA, password-only sign-ins, password sprays, accounts that got in after a run of wrong passwords, sign-ins from unusual countries, and admin accounts reading email. Read in your browser.
Sign-in check1 Summary
2 The checks
3 What this could not check
Read from the sign-in log you supplied, in your browser; nothing was sent to us. A finding is a reason to look, not proof of a break-in. Guidance, not an investigation; see the terms.
A Global Reader or Security Reader can download it. Entra keeps 7 days on the free tier and 30 with P1 or P2.
Connect-MgGraph -Scopes AuditLog.Read.AllGet-MgAuditLogSignIn -All | ConvertTo-Json -Depth 5 | Out-File signins.json-Filter "createdDateTime ge 2026-09-26" for a shorter period.What happens to it: it is read in your browser and dropped once the report is drawn. Nothing is uploaded, and nothing signs in to your tenant. Our copy of your details carries only the counts.
The questions people search for before they run the check.
Download the sign-in log from the Entra admin centre (Sign-in logs, Download, CSV) and look for sign-ins from unusual countries, a success after many failed passwords, and legacy clients such as IMAP. This check reads the log and points those out.
Older protocols such as IMAP, POP, SMTP AUTH and ActiveSync send a password without any second factor, so they ignore MFA. Attackers use them to get into mailboxes with stolen passwords. Block them with a Conditional Access policy or security defaults.
Many failed sign-ins with error 50126 (invalid username or password) from one IP address, spread across many different accounts, often at night. The danger is the one account that then succeeds.
Seven days on the free tier and 30 days with Entra ID P1 or P2. To keep them longer, send them to a Log Analytics workspace or your SIEM; CERT-In expects 180 days of logs.
No. It is read in your browser, and nothing signs in to your tenant. If you ask for the report, we keep your details and a one-line summary with the counts.
MFA for everyone, the old protocols switched off, admins kept apart, and someone watching the sign-ins: that is what turns a phished password into a non-event.