Unable to download interactive sign-in logs

Question

Unable to download interactive sign-in logs

Steven Heicher 0

I'm trying to download the last month's sign-in logs within the Entra Admin Center. However, it waits about 10-12 minutes, and then it says it failed. Further, it says that it's being throttled.

Attached are the errors and what I'm trying to download. I've tried both CSV and JSON.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Antony Maxwin 20 Reputation points

2025-11-07T06:07:51.37+00:00

Hi @Steven Heicher
The error showing that you are trying to download the sign in logs but the size greater than the maximum where it supported , So better you try to export this to a storage account .

Step from GPT for this .

Go to:

https://entra.microsoft.com

→ Microsoft Entra ID → Monitoring & health → Diagnostic settings

(or from Sign-in logs → click Export Data Settings)

Click + Add diagnostic setting.

Give it a name (e.g., SignInLogsToStorage).

Under Logs, tick Sign-in logs (and Audit logs if desired).

Under Destination details, select Archive to a storage account.

Choose the subscription and your Storage Account → Save.

✅ Result: Azure will start pushing JSON sign-in records automatically to your storage container (usually /insights-logs-signinlogs/resourceId=.../y=YYYY/m=MM/d=DD/h=HH/m=00/PT1H.json).

Please let me know if need any help i will simulate and give you more details
if it worked please mark the answer as helpful. or you can post how you resolved it.
Steven Heicher 0 Reputation points

2025-11-07T14:26:30.72+00:00

@Antony Maxwin So I can tell you this. We average 90,000-97,000 records per month total... That includes every interactive sign-in in our tenant.

However, it's failing even when I narrow it down to 7 days and 24 hours of data. I don't think it's a record count. It's throttling even when I do a narrow period. I was able to get 24 hours, and I got 3482 records. Even if I were to take that number and multiply that by 30, it would be about 104k logins, but I can tell you, you would have Fridays weekends where login attempts would drop off.
Jennifer Bader 0 Reputation points

2026-11-10T17:50:50.25+00:00

Same issue, probably due to SIEM. They need to upgrade to support higher frequency for paying customers, especially E5.

1 answer

Antony Maxwin 20 Reputation points

2025-11-07T06:07:51.37+00:00

Hi @Steven Heicher
The error showing that you are trying to download the sign in logs but the size greater than the maximum where it supported , So better you try to export this to a storage account .

Step from GPT for this .

Go to:

https://entra.microsoft.com

→ Microsoft Entra ID → Monitoring & health → Diagnostic settings

(or from Sign-in logs → click Export Data Settings)

Click + Add diagnostic setting.

Give it a name (e.g., SignInLogsToStorage).

Under Logs, tick Sign-in logs (and Audit logs if desired).

Under Destination details, select Archive to a storage account.

Choose the subscription and your Storage Account → Save.

✅ Result: Azure will start pushing JSON sign-in records automatically to your storage container (usually /insights-logs-signinlogs/resourceId=.../y=YYYY/m=MM/d=DD/h=HH/m=00/PT1H.json).

Please let me know if need any help i will simulate and give you more details
if it worked please mark the answer as helpful. or you can post how you resolved it.
Steven Heicher 0 Reputation points

2025-11-07T14:26:30.72+00:00

@Antony Maxwin So I can tell you this. We average 90,000-97,000 records per month total... That includes every interactive sign-in in our tenant.

However, it's failing even when I narrow it down to 7 days and 24 hours of data. I don't think it's a record count. It's throttling even when I do a narrow period. I was able to get 24 hours, and I got 3482 records. Even if I were to take that number and multiply that by 30, it would be about 104k logins, but I can tell you, you would have Fridays weekends where login attempts would drop off.
Jennifer Bader 0 Reputation points

2026-11-10T17:50:50.25+00:00

Same issue, probably due to SIEM. They need to upgrade to support higher frequency for paying customers, especially E5.

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more