Suspicious Login Issues

Fix Missing Failed Login Events in Azure AD Sign-In Logs

Adam Davis Oct 21, 2026 868 views

Question details

The user is unable to find failed login attempts in the Azure AD (Microsoft Entra ID) sign-in logs, despite authentication failures actively occurring.

How to Fix Missing Failed Login Events in Azure AD Sign-In Logs

Product: Azure Active Directory (Microsoft Entra ID)
Device & OS: not provided
Scenario: Reviewing security logs and investigating suspicious login activities in an Azure or AD FS federated environment.
Observed behavior: Failed sign-in events recorded by AD FS or other local authentication paths are completely missing from the cloud-based Microsoft Entra sign-in logs.

Before you start

Ensure you have the necessary Global Administrator, Security Administrator, or Security Reader permissions in your Microsoft Entra tenant to view comprehensive sign-in logs.

Solution 1Recommended

Check Microsoft Entra Sign-In Logs and Adjust Filters

Verify your log filters, date ranges, and log categories in the Entra ID portal to ensure the failed events aren't simply hidden by default views.

Microsoft Entra ID separates interactive and non-interactive sign-ins. Often, failed authentications from legacy protocols or automated processes are categorized as non-interactive.

Access the Admin Center

Navigate to Sign-in Logs

Go to Identity > Monitoring & health > Sign-in logs from the left-hand navigation menu.

Adjust Date and Status Filters

Click the 'Date' filter to expand the timeframe, then add a 'Status' filter and set it specifically to 'Failure'.

Check Alternate Log Tabs

Review the 'Non-interactive user sign-ins' and 'Service principal sign-ins' tabs, as the missing failed event may not have involved an active user session.

Check Microsoft Entra Sign-In Logs and Adjust Filters

Data Retention Limits: Keep in mind that Microsoft Entra ID retains sign-in logs for 30 days for Premium P1/P2 licenses, and only 7 days for free editions.

Solution 2

Compare AD FS and Cloud Authentication Paths

Because federation handles logins differently, verify if the authentication failure stopped at the on-premises AD FS level before it could reach Entra ID.

Solution 3

Consult Microsoft Identity Specialists

If federation configurations are preventing log synchronization and you cannot trace the disconnect, escalate the issue to Azure identity specialists.

Free Microsoft Office alternative

Manage Your IT and Security Reports with WPS Office

While troubleshooting Azure AD and Entra ID requires Microsoft's administrative portals, documenting your security audits, compliance reports, and IT workflows is easier with WPS Office. It provides a lightweight, free alternative to Microsoft Office with a highly compatible and familiar interface.

1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
2. Document Your Findings: Open WPS Writer or Spreadsheet to start logging your security audits and AD FS troubleshooting notes.
3. Save and Share: Save your IT reports in .docx or .xlsx formats to ensure seamless sharing and collaboration with your internal security team.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Create detailed security audit reports and IT documentation easily.Lightweight design that runs smoothly on almost any desktop environment.Familiar user interface minimizes the learning curve for IT professionals.

microsoft office alternative - wps office

Frequently Asked Questions

Why do some failed AD FS logins not show up in Azure AD?

If an authentication attempt fails early at the on-premises AD FS level (e.g., due to a bad password or a local account lockout), the request is dropped locally. AD FS does not always forward these early-stage failure events to Microsoft Entra ID.

What permissions are required to view Azure AD sign-in logs?

You must be assigned the Security Administrator, Security Reader, Global Reader, or Reports Reader role in Microsoft Entra ID to access and review the comprehensive sign-in logs.

Can conditional access policies affect sign-in log visibility?

Conditional access policies do not delete logs. However, if a policy blocks an authentication attempt early in the sequence, it may be recorded as an 'interrupted' or 'non-interactive' sign-in rather than appearing in your standard interactive failure logs.

Where can I find non-interactive sign-in logs in Microsoft Entra?

In the Microsoft Entra admin center, under the Sign-in logs section, click on the 'Non-interactive user sign-ins' tab. Many background authentication failures, such as token refreshes or managed identity requests, are logged here rather than in the main interactive tab.

Microsoft Office Security Issues