Suspicious Login Issues

What Device Information Is Available in Azure Sign-In Logs?

Aamir Naveed Akram Oct 9, 2026 868 views

Question details

The user wants to know if Azure sign-in logs provide a unique computer identifier and first-access timestamps to investigate an account that was compromised despite MFA.

What Device Information Is Available in Azure Sign-In Logs?

Product: Azure / Microsoft Entra ID
Device & OS: not provided
Scenario: Investigating a compromised account that seemingly bypassed Multi-Factor Authentication (MFA) using a remembered device.
Observed behavior: The administrator is looking for unique physical hardware identifiers in the logs to pinpoint the exact compromised device.

Before you start

Ensure you have the necessary administrative privileges (such as Security Reader, Reports Reader, or Global Administrator) in the Microsoft Entra admin center to view and analyze sign-in logs.

Solution 1Recommended

Reviewing Device Information in Microsoft Entra Sign-In Logs

Access and filter interactive and non-interactive sign-in logs to track down compromised device details and identify suspicious authentication patterns.

Microsoft Entra (formerly Azure AD) sign-in logs record various data points including the device name, operating system, browser, IP address, location, and authentication method. However, they generally do not provide a unique hardware identifier (like a MAC address) for the physical computer unless the device is fully managed and registered via Intune.

To properly investigate an MFA bypass involving a remembered device, you must review both interactive and non-interactive sign-ins to piece together the attacker's activities.

Access Sign-In Logs

Sign in to the Microsoft Entra admin center as an administrator. Navigate to 'Identity', expand the 'Monitoring & health' section, and click on 'Sign-in logs'.

Filter the Activity

Use the 'Add filters' option to search by 'Device info' or 'IP address' to isolate the suspicious activity from the compromised account.

Examine Authentication Details

Click on a specific suspicious log entry and open the 'Authentication Details' tab. Look for claims indicating a 'remembered device' or specific MFA methods used during the breach.

Check Non-Interactive Logs

Switch to the 'Non-interactive user sign-ins' tab at the top of the logs page to identify background token refreshes or persistent sessions maintained by the attacker.

Reviewing Device Information in Microsoft Entra Sign-In Logs

Hardware Identifiers: Because standard Azure sign-in logs rely on user-agent strings and network context, relying on IP addresses and device names is currently the best approach for tracking unfamiliar devices in unmanaged environments.

Free Microsoft Office alternative

Secure and Manage Your Documents with WPS Office

While investigating complex Azure security logs for your enterprise, consider simplifying your daily document workflows with WPS Office. It provides a lightweight, highly compatible alternative to Microsoft Office without the heavy enterprise administrative overhead.

1. Download the software: Visit the official WPS Office website and select the free download option for your current operating system.
2. Install and launch: Run the installer and follow the on-screen prompts. Once installed, open WPS Office to access Writer, Spreadsheets, and Presentation.
3. Open existing files securely: Drag and drop your existing Microsoft Office files into WPS Office to view and edit them with seamless compatibility and built-in security features.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Built-in document encryption and password protection to keep local files secure.Free, lightweight, and easy to deploy across various devices and operating systems.

microsoft office alternative - wps office

Frequently Asked Questions

Can I find a unique hardware ID or MAC address in Azure sign-in logs?

No, standard Microsoft Entra sign-in logs typically show the device name, operating system, browser, and IP address, but they do not capture physical hardware identifiers like a MAC address unless the device is managed by an MDM solution like Intune.

How can I tell if an attacker bypassed MFA using a remembered device?

In the sign-in logs, select the suspicious sign-in event and check the 'Authentication Details' tab. If the session utilized a remembered device, the log will indicate that the MFA requirement was previously satisfied by that specific device.

Where do I find the non-interactive sign-in logs in Azure?

Within the Microsoft Entra admin center, go to 'Monitoring & health' > 'Sign-in logs'. You will see multiple tabs at the top; click on 'Non-interactive user sign-ins' to view background authentications that don't require active user prompts.

Microsoft Office Security Issues