'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Why Microsoft Entra Sign-In Logs Show No Recent Activity for Active Users
Question details
Active Microsoft 365 users do not appear to have recent activity in Microsoft Entra sign-in logs.
- Product
- Microsoft Entra / Microsoft 365
- Device & OS
- not provided
- Scenario
- Monitoring user login activity and auditing access logs within the Microsoft Entra admin center.
- Observed behavior
- The sign-in logs show no recent interactive sign-in records for users who are actively using Office applications.
Ensure you have the appropriate administrative privileges, such as Security Reader or Global Administrator, to view comprehensive sign-in logs in the Microsoft Entra admin center.
Check Non-Interactive Sign-In Logs in Microsoft Entra
Review the non-interactive sign-in records to see background service activity and token-based access for active users.
Office applications utilize authentication tokens to keep users signed in continuously without requiring them to enter their credentials repeatedly.
Because the apps use these existing tokens to authenticate in the background, active usage typically generates non-interactive sign-in records rather than interactive ones. This behavior is completely normal and expected.
Sign in to the Microsoft Entra admin center using your administrator credentials.
In the left-hand navigation menu, expand the 'Identity' section, go to 'Monitoring & health', and select 'Sign-in logs'.
At the top of the logs page, click on the 'Non-interactive user sign-ins' tab.
Use the 'Add filters' button to search for the specific user's principal name (UPN) to verify their background authentication and token refresh activity.
Looking for a Lightweight Office Suite? Try WPS Office
If you are managing software licenses and looking for a straightforward, cost-effective solution, WPS Office provides a highly compatible and free alternative to Microsoft Office. Enjoy a familiar interface without complex cloud authentication hurdles.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button.
- 2. Install the Suite: Run the downloaded installation file and follow the simple on-screen instructions.
- 3. Open and Create: Launch WPS Office to instantly start working on your documents, spreadsheets, and presentations with full Microsoft format support.
Frequently Asked Questions
What is the difference between interactive and non-interactive sign-ins in Microsoft Entra?
Interactive sign-ins require the user to provide an authentication factor, such as a password or MFA prompt. Non-interactive sign-ins occur in the background when a client application uses a previously acquired token to access resources on the user's behalf.
How long do Office authentication tokens typically last?
Microsoft Entra issues refresh tokens that can remain valid for up to 90 days of continuous use. As long as the user regularly opens their Office apps, the token refreshes automatically, bypassing the need for an interactive sign-in.
Can an administrator force a user to sign in interactively?
Yes. An administrator can go to the user's profile in the Microsoft Entra admin center and select 'Revoke sessions'. This invalidates their current tokens and forces a new interactive sign-in prompt across all their connected devices.
