'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Why Azure AD Sign-In Logs Show an Object GUID Instead of a UPN
Question details
The user wants to understand why Microsoft Entra ID (formerly Azure AD) sign-in logs sometimes display an object GUID in the UPN field instead of the actual User Principal Name, and whether these entries can be excluded from analysis.
- Product
- Microsoft Entra ID (Azure AD)
- Device & OS
- not provided
- Scenario
- Reviewing and auditing account security and sign-in logs in the Microsoft Entra admin center.
- Observed behavior
- The sign-in logs show a system-generated Object GUID in the User Principal Name (UPN) field instead of a human-readable email format.
Ensure you have at least a Security Reader or Reports Reader role assigned in Microsoft Entra ID to access and filter the tenant's sign-in logs.
Identify the Source of the Object GUID and Apply Log Filters
Determine if the GUID belongs to a deleted user, service principal, or managed identity, and use Entra ID filters to exclude them from standard user audits.
In Microsoft Entra ID, an Object GUID appears instead of a UPN when the system cannot resolve the principal's human-readable name. This typically occurs for deleted user accounts, managed identities, service principals, or external guest users whose UPNs are not fully provisioned in the directory.
If these entries interfere with your routine security analysis, you can easily filter them out using the built-in diagnostic tools.
Log in to the Microsoft Entra admin center, expand the 'Identity' menu, and navigate to 'Monitoring & health' > 'Sign-in logs'.
Copy the Object GUID from the UPN field. Navigate to 'Users' or 'Enterprise applications' and paste the GUID into the search bar to identify whether it belongs to a deleted user account or an automated app.
Click 'Add filters' at the top of the Sign-in logs view. Select 'User Principal Name', set the condition to 'Does not start with', and input the GUID format, or simply switch tabs to isolate 'Service principal sign-ins' from 'Interactive user sign-ins'.
Looking for a Secure, Lightweight Office Suite?
While you manage complex IT infrastructure and account security in Entra ID, your daily document tasks shouldn't be a hassle. WPS Office provides a lightweight, highly compatible, and secure alternative for enterprise productivity.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for Windows, macOS, or Linux.
- 2. Install WPS Office: Run the downloaded installer and follow the quick on-screen instructions to complete the setup.
- 3. Open Your Documents: Launch WPS Office and instantly open your existing Microsoft Word, Excel, or PowerPoint files without losing any formatting.
Frequently Asked Questions
Can I permanently convert the Object GUID back to a UPN in Azure AD logs?
No. If the original UPN was removed from the directory (e.g., the user was permanently deleted), the sign-in log will permanently display the Object GUID. You can only cross-reference this GUID with historical audit logs to find the original user identity.
Do managed identities generate sign-in logs with a standard UPN?
No. Managed identities and service principals authenticate using their Object ID or Application ID. Since they do not have a standard email-style User Principal Name, you will see a GUID in the UPN field.
How do I completely exclude service principal sign-ins from my analysis?
In the Entra admin center 'Sign-in logs' section, utilize the tabs at the top. Switching from the 'Interactive user sign-ins' tab to the 'Service principal sign-ins' tab naturally separates machine-generated logs from human user activities.
