Entra Sign In Logs

Question

Entra Sign In Logs

Ren G 75

Sign in logs in Entra will not load for anything over the 24 hour time period. I receive one of three notifications:

The server is receiving too many requests. Please wait a few minutes before trying again.
Something went wrong. Please retry.
Requests to the server are being throttled. Please retry after 30 seconds.

There are forums with multiple other people across the country having this issue, and I can replicate this issue across several environments that I have access to on my own, so I know it is not specific to our environment or caused by our configurations.

Not being able to pull sign in logs for users past 24 hours creates a huge security concern. How can I get this resolved?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Vishal Gupta 25 Reputation points

2025-11-24T17:03:47.02+00:00

Same issue happening with my tenant right now (7k+ users). Has been happening since Nov 20 and getting worse.
Underwood, Neil 25 Reputation points

2025-11-24T21:08:48.59+00:00

I'd like to know what's going on as well. As a security analyst I need to review these logs frequently. I cannot perform my job with Entra logs in their current state. I can only get 24 hours of logs loaded, if that even works. There is no public statement from Microsoft acknowledging this issue but it's been going on since at lesat 11/20 as Vishal has stated.
Scott Caldwell 40 Reputation points

2025-11-24T22:14:02.46+00:00

This is also an issue for my organization where it's been an issue for almost a month. There was a week in there where it worked, but has since become a major failure point again.

The overall issue is not just that reports won't generate, but the sorting is also broken. If we sort with just the default "7-Days" and add "Status" (including "Success"), then all additional sorting for "Application", "Resource", and "Resource ID" fails. I can see "Azure Virtual Desktop" listed if we don't include the Application, Resource, or Resource ID criteria, but as soon as we add any of those as criteria, then Entra ID states it finds no data!?!

We use this information weekly, so please fix this, Microsoft. It worked before the "new" alternate interface was added. BTW, this whole process ALSO fails when using the new alternate interface.
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-11-25T14:25:33.1733333+00:00

Hello Ren G, We will check internally and get back to you shortly!
Scott Caldwell 40 Reputation points

2025-11-25T14:42:41.7766667+00:00

Thank you, Rukmini. We all appreciate any assistance you can provide.

Someone suggested we run reports with only three days. However, we need a month of logs, so it is completely impractical to run 10 three days reports, then merge them together. As noted, we also try to only search on “Status: Success” and “Application” OR “Resource”, which greatly reduces the size of the report (well under the 10,000 row limit). However, if we use Status And Application OR Resource, then the report says nothing matches those latter two search criteria when I can clearly see them in the regular report with just Status. We search on “Azure Virtual Desktop”, “Azure Virtual Desktop Client”, and “Windows App”.

BTW, when the search works, it is only showing “Windows App” for Android, IOS, and MacOS. Nothing about the hundreds of Windows installations we have. That needs to also be fixed by Microsoft.

This morning, the search criteria is working for Status and Application, but the report still fails to download (Download Sign-ins in CSV format - Download failed).
Frederick Rondeau 30 Reputation points

2025-11-25T16:59:34.96+00:00

Still ongoing as of November 25th, 11:55am EST.

Looking at sign-in logs and diagnosing Conditional Access is an absolute pain. It takes up to a couple of minutes to fetch a dozen login of a single user over 24 hours and that's if results are returned at all.
Sometimes there won't be any results, when there were moments earlier. The errors mentioned by OP will sometimes show up, sometimes not. Sometimes results will be displayed despite the errors, sometimes no results will display despite no errors.

What a mess.
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-11-26T12:13:20.3633333+00:00
Hello Ren G,

This issue "Entra sign-in logs not loading beyond 24 hours" is observed across multiple tenants and environments and Multiple customers are experiencing the same problem. Based on this, we need to involve engineering team on this and will update you.

WORKAROUND:

Getting the Sign-in Logs from Microsoft Graph:

Navigate to Microsoft Graph Explorer: https://developer.microsoft.com/en-us/graph/graph-explorer

Sign in

In the empty box next to v1.0 enter the following: https://graph.microsoft.com/v1.0/auditLogs/signIns

Click Run query

The response preview section should have information from the sign in logs in JSON format

If you would like to convert to a CSV and open in Excel, we can do the following additional steps:

Copy the text in the Response Preview section

Use a tool such as this to convert JSON to CSV: https://www.convertcsv.com/json-to-csv.htm

Copy that information into Notepad, and save the file

Open Excel, and search for From Text/CSV

Follow the steps, and you will get a readable version of the Sign In Logs in the same format the Azure AD Sign-in Logs will downloaded
Jack George 10 Reputation points

2025-11-26T14:04:05.37+00:00

I'm experiencing this issue as well. I can run a 24 hour Sign-in log, but 1 month or 7 days does not work, or takes multiple tries to catch up and load the entry. Despite any report, trying to download them as .CSV is always Failing, and I need at least 1 month of sign-in results for a client.
Fox, David 5 Reputation points

2025-11-26T16:20:41.8266667+00:00

Rukmini • Microsoft External Staff • Moderator Nov 26, 2025, 5:13 AM confirmed this is a multitenant problem and is engaging the engineering team.

Is maybe the better answer.
Fox, David 5 Reputation points

2025-11-26T16:21:48.32+00:00

Confirmed is also a problem in Alberta, Canada and has been for over a month.
Also Audit logs sometimes has the same problem.
We tend to default over to sentinel when we cant load the normal logs.
Charles Loveland 15 Reputation points

2025-11-28T00:20:58.7366667+00:00

We have been experiencing this issue for a couple weeks now as well. When it started we could sometimes pull 7 days. Also noticing that even pulling Entra Audit logs is inconsistent for the same user as to whether or not activity of any sort is even showing up for the last 24 hour. I have logins for last 24 hours in sign-in logs and Entra logs show no activity at all in the same time period. Non-working audit logs is a serious issue.
Charles Loveland 15 Reputation points

2025-11-28T00:37:29.1633333+00:00

Rukmini's suggestion did not work for me because the query in Graph Explorer appears to timeout as well.
Ren G 75 Reputation points

2025-11-28T15:34:29.7033333+00:00

HI Rukimi,

Thanks for the suggested Graph workaround. Unfortunately, as Charles also mentioned, this request times out as well. I can occasionally get a response to load, but interestingly the page will refresh seconds later and display a time out error.
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-11-28T15:36:10.7833333+00:00

Hello Ren G, We will check internally with our Engineering team and get back to you shortly!
gstevens 0 Reputation points

2025-12-01T17:50:50.4133333+00:00

Rukmini, please provide the incident/issue ID for the active issue so we can track the status in the service health dashboards.
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-12-01T19:03:24.4266667+00:00

Hello Ren G,

We have engaged our Engineering team and confirmed that this issue will be mitigated in 2 days.

Thank you for the patience!
Scott Caldwell 40 Reputation points

2025-12-01T19:31:12.7733333+00:00

Rukmini, thank you for the update.

Please ensure the engineering team is aware of the numerous issues and examples provided in this thread. Said another way, it's not just one issue.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer accepted by question author

Rukmini 44,000 Microsoft External Staff Moderator

Hello Ren G,

As confirmed by our Engineering team, the issue has been resolved and interventions have stopped.

Please check now!

Thank you for your patience!

If the resolution was helpful, kindly take a moment to accept the answer and upvote it 👍 it as a token of appreciation.

Scott Caldwell 40 Reputation points

2025-12-03T17:12:04.6866667+00:00

We just tested this using the following search criteria and it worked!

1 Month and Status: Success
1 Month, Status: Success, and Resource: Azure Virtual Desktop

It also only took a few minutes to download each report. Hooray!
Frederick Rondeau 30 Reputation points

2025-12-03T18:07:28.7433333+00:00

Everything looks fine to me too!
TSims 10 Reputation points

2025-12-04T15:20:01.6133333+00:00

I'm still having this issue, currently, trying to view single-user logs for 7- and 30-day sign-ins.
VC 10 Reputation points

2025-12-04T16:19:09.4333333+00:00

Still having issues, cannot pull logs of more than a day not even for 1 user
Marvin Solon 10 Reputation points

2025-12-04T17:18:04.0833333+00:00

Still having throttling issues - custom, 7 and 30 days aren't even displaying. 24 sign-in logs are also elusive sometimes if not most of it.
tato386 86 Reputation points

2025-12-04T18:26:35.7066667+00:00

not working for me. similar to others with only 24hr activity shows. slow to populate and sometimes see error even when using 24hr filter
tato386 86 Reputation points

2025-12-04T18:28:22.43+00:00

still having issues
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-12-04T18:30:21.11+00:00

Hello, We will check internally and get back to you!
MartinhDK 0 Reputation points

2025-12-05T09:11:33.39+00:00

Rukmini,
Is there an official status / incident for this in Message Center, Service Health or similar?
The issue seems to be widespread and probably deserves an official Incident?

Best regards
Martin
Scott Caldwell 40 Reputation points

2025-12-05T14:11:47.6533333+00:00

We tested again yesterday afternoon and the report failed to download. We tested this morning and it downloaded successfully.

Is it working for everyone else? Please test and reply in this thread.
Ren G 75 Reputation points

2025-12-05T14:11:52.5866667+00:00

Hi Rukimi,

Greatly appreciate your assistance. My particular issue appears to be resolved. User sign in logs are now loading for both 1 week and 1 month intervals. It appears others are still experiencing issues, so if my issue returns I will report back.
tato386 86 Reputation points

2025-12-05T15:43:47.4166667+00:00

I am still seeing issues. For example, the 24hr report will run a show a handful of events then I switch to 7 day and after 2-3 mins of spinning it comes back empty? No results for 7 days even though the 24hr report showed activity is definitely not right. I also see "something went wrong" message but for what it's worth, I haven't see the throttling error any more.
Gary Miles 0 Reputation points

2025-12-08T13:48:15.8933333+00:00

Our company is also having issues running logs of anything over 24 hours - its been going on for weeks ?
Stephan Hamby 0 Reputation points

2025-12-08T23:47:13.6366667+00:00

We are having these issues across many clients and tenants, sign-in logs for anything larger than 24 hours consistently fail to generate
Frederick Rondeau 30 Reputation points

2025-12-09T15:04:52.3233333+00:00

Now I am experiencing the issue again, but it is a bit different. Sign-in logs for those display fine when looking at the last 24 hours or 7 days, but logs for 1 month sometimes return "Something went wrong. Please retry." after a few minutes of loading. Sometimes the 1 month log will display fine though.

I've found that some users have many events, and those will display all logs just fine every time. Others however do not have many logs at all, and getting 1 month logs for those will usually fail.
What is strange is that the 24 hours and 7 days logs will show sign-in events just fine, but it seems like the 1 month logs cannot find the same events that the other time frames did.
notmyrealname 16 Reputation points

2025-12-09T18:15:48.7733333+00:00

Still issues across multiple tenants. Unsatisfactory resolution.
CB-5092 0 Reputation points

2026-01-14T12:30:06.3766667+00:00

Getting the same issue for the past 2 days, not able to download even 24 hours worth of logs - UK Tenant.

What's the point of preventing people from being able to download logs if they need to.
Jan Hansen 36 Reputation points

2026-01-20T08:01:30.23+00:00

Same Issue for swiss tenant....
Jennifer Bader 0 Reputation points

2026-11-10T17:52:27.3533333+00:00

Still having throttling issues.

1 additional answer

Vishal Gupta 25 Reputation points

2025-11-24T17:03:47.02+00:00

Same issue happening with my tenant right now (7k+ users). Has been happening since Nov 20 and getting worse.
Underwood, Neil 25 Reputation points

2025-11-24T21:08:48.59+00:00

I'd like to know what's going on as well. As a security analyst I need to review these logs frequently. I cannot perform my job with Entra logs in their current state. I can only get 24 hours of logs loaded, if that even works. There is no public statement from Microsoft acknowledging this issue but it's been going on since at lesat 11/20 as Vishal has stated.
Scott Caldwell 40 Reputation points

2025-11-24T22:14:02.46+00:00

This is also an issue for my organization where it's been an issue for almost a month. There was a week in there where it worked, but has since become a major failure point again.

The overall issue is not just that reports won't generate, but the sorting is also broken. If we sort with just the default "7-Days" and add "Status" (including "Success"), then all additional sorting for "Application", "Resource", and "Resource ID" fails. I can see "Azure Virtual Desktop" listed if we don't include the Application, Resource, or Resource ID criteria, but as soon as we add any of those as criteria, then Entra ID states it finds no data!?!

We use this information weekly, so please fix this, Microsoft. It worked before the "new" alternate interface was added. BTW, this whole process ALSO fails when using the new alternate interface.
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-11-25T14:25:33.1733333+00:00

Hello Ren G, We will check internally and get back to you shortly!
Scott Caldwell 40 Reputation points

2025-11-25T14:42:41.7766667+00:00

Thank you, Rukmini. We all appreciate any assistance you can provide.

Someone suggested we run reports with only three days. However, we need a month of logs, so it is completely impractical to run 10 three days reports, then merge them together. As noted, we also try to only search on “Status: Success” and “Application” OR “Resource”, which greatly reduces the size of the report (well under the 10,000 row limit). However, if we use Status And Application OR Resource, then the report says nothing matches those latter two search criteria when I can clearly see them in the regular report with just Status. We search on “Azure Virtual Desktop”, “Azure Virtual Desktop Client”, and “Windows App”.

BTW, when the search works, it is only showing “Windows App” for Android, IOS, and MacOS. Nothing about the hundreds of Windows installations we have. That needs to also be fixed by Microsoft.

This morning, the search criteria is working for Status and Application, but the report still fails to download (Download Sign-ins in CSV format - Download failed).
Frederick Rondeau 30 Reputation points

2025-11-25T16:59:34.96+00:00

Still ongoing as of November 25th, 11:55am EST.

Looking at sign-in logs and diagnosing Conditional Access is an absolute pain. It takes up to a couple of minutes to fetch a dozen login of a single user over 24 hours and that's if results are returned at all.
Sometimes there won't be any results, when there were moments earlier. The errors mentioned by OP will sometimes show up, sometimes not. Sometimes results will be displayed despite the errors, sometimes no results will display despite no errors.

What a mess.
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-11-26T12:13:20.3633333+00:00

Hello Ren G,

This issue "Entra sign-in logs not loading beyond 24 hours" is observed across multiple tenants and environments and Multiple customers are experiencing the same problem. Based on this, we need to involve engineering team on this and will update you.

WORKAROUND:

Getting the Sign-in Logs from Microsoft Graph:

Navigate to Microsoft Graph Explorer: https://developer.microsoft.com/en-us/graph/graph-explorer

Sign in

In the empty box next to v1.0 enter the following: https://graph.microsoft.com/v1.0/auditLogs/signIns

Click Run query

The response preview section should have information from the sign in logs in JSON format

If you would like to convert to a CSV and open in Excel, we can do the following additional steps:

Copy the text in the Response Preview section

Use a tool such as this to convert JSON to CSV: https://www.convertcsv.com/json-to-csv.htm

Copy that information into Notepad, and save the file

Open Excel, and search for From Text/CSV

Follow the steps, and you will get a readable version of the Sign In Logs in the same format the Azure AD Sign-in Logs will downloaded
Jack George 10 Reputation points

2025-11-26T14:04:05.37+00:00

I'm experiencing this issue as well. I can run a 24 hour Sign-in log, but 1 month or 7 days does not work, or takes multiple tries to catch up and load the entry. Despite any report, trying to download them as .CSV is always Failing, and I need at least 1 month of sign-in results for a client.
Fox, David 5 Reputation points

2025-11-26T16:20:41.8266667+00:00

Rukmini • Microsoft External Staff • Moderator Nov 26, 2025, 5:13 AM confirmed this is a multitenant problem and is engaging the engineering team.

Is maybe the better answer.
Fox, David 5 Reputation points

2025-11-26T16:21:48.32+00:00

Confirmed is also a problem in Alberta, Canada and has been for over a month.
Also Audit logs sometimes has the same problem.
We tend to default over to sentinel when we cant load the normal logs.
Charles Loveland 15 Reputation points

2025-11-28T00:20:58.7366667+00:00

We have been experiencing this issue for a couple weeks now as well. When it started we could sometimes pull 7 days. Also noticing that even pulling Entra Audit logs is inconsistent for the same user as to whether or not activity of any sort is even showing up for the last 24 hour. I have logins for last 24 hours in sign-in logs and Entra logs show no activity at all in the same time period. Non-working audit logs is a serious issue.
Charles Loveland 15 Reputation points

2025-11-28T00:37:29.1633333+00:00

Rukmini's suggestion did not work for me because the query in Graph Explorer appears to timeout as well.
Ren G 75 Reputation points

2025-11-28T15:34:29.7033333+00:00

HI Rukimi,

Thanks for the suggested Graph workaround. Unfortunately, as Charles also mentioned, this request times out as well. I can occasionally get a response to load, but interestingly the page will refresh seconds later and display a time out error.
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-11-28T15:36:10.7833333+00:00

Hello Ren G, We will check internally with our Engineering team and get back to you shortly!
gstevens 0 Reputation points

2025-12-01T17:50:50.4133333+00:00

Rukmini, please provide the incident/issue ID for the active issue so we can track the status in the service health dashboards.
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-12-01T19:03:24.4266667+00:00

Hello Ren G,

We have engaged our Engineering team and confirmed that this issue will be mitigated in 2 days.

Thank you for the patience!
Scott Caldwell 40 Reputation points

2025-12-01T19:31:12.7733333+00:00

Rukmini, thank you for the update.

Please ensure the engineering team is aware of the numerous issues and examples provided in this thread. Said another way, it's not just one issue.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Scott Caldwell 40 Reputation points

2025-12-03T17:12:04.6866667+00:00

We just tested this using the following search criteria and it worked!

1 Month and Status: Success
1 Month, Status: Success, and Resource: Azure Virtual Desktop

It also only took a few minutes to download each report. Hooray!
Frederick Rondeau 30 Reputation points

2025-12-03T18:07:28.7433333+00:00

Everything looks fine to me too!
TSims 10 Reputation points

2025-12-04T15:20:01.6133333+00:00

I'm still having this issue, currently, trying to view single-user logs for 7- and 30-day sign-ins.
VC 10 Reputation points

2025-12-04T16:19:09.4333333+00:00

Still having issues, cannot pull logs of more than a day not even for 1 user
Marvin Solon 10 Reputation points

2025-12-04T17:18:04.0833333+00:00

Still having throttling issues - custom, 7 and 30 days aren't even displaying. 24 sign-in logs are also elusive sometimes if not most of it.
tato386 86 Reputation points

2025-12-04T18:26:35.7066667+00:00

not working for me. similar to others with only 24hr activity shows. slow to populate and sometimes see error even when using 24hr filter
tato386 86 Reputation points

2025-12-04T18:28:22.43+00:00

still having issues
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-12-04T18:30:21.11+00:00

Hello, We will check internally and get back to you!
MartinhDK 0 Reputation points

2025-12-05T09:11:33.39+00:00

Rukmini,
Is there an official status / incident for this in Message Center, Service Health or similar?
The issue seems to be widespread and probably deserves an official Incident?

Best regards
Martin
Scott Caldwell 40 Reputation points

2025-12-05T14:11:47.6533333+00:00

We tested again yesterday afternoon and the report failed to download. We tested this morning and it downloaded successfully.

Is it working for everyone else? Please test and reply in this thread.
Ren G 75 Reputation points

2025-12-05T14:11:52.5866667+00:00

Hi Rukimi,

Greatly appreciate your assistance. My particular issue appears to be resolved. User sign in logs are now loading for both 1 week and 1 month intervals. It appears others are still experiencing issues, so if my issue returns I will report back.
tato386 86 Reputation points

2025-12-05T15:43:47.4166667+00:00

I am still seeing issues. For example, the 24hr report will run a show a handful of events then I switch to 7 day and after 2-3 mins of spinning it comes back empty? No results for 7 days even though the 24hr report showed activity is definitely not right. I also see "something went wrong" message but for what it's worth, I haven't see the throttling error any more.
Gary Miles 0 Reputation points

2025-12-08T13:48:15.8933333+00:00

Our company is also having issues running logs of anything over 24 hours - its been going on for weeks ?
Stephan Hamby 0 Reputation points

2025-12-08T23:47:13.6366667+00:00

We are having these issues across many clients and tenants, sign-in logs for anything larger than 24 hours consistently fail to generate
Frederick Rondeau 30 Reputation points

2025-12-09T15:04:52.3233333+00:00

Now I am experiencing the issue again, but it is a bit different. Sign-in logs for those display fine when looking at the last 24 hours or 7 days, but logs for 1 month sometimes return "Something went wrong. Please retry." after a few minutes of loading. Sometimes the 1 month log will display fine though.

I've found that some users have many events, and those will display all logs just fine every time. Others however do not have many logs at all, and getting 1 month logs for those will usually fail.
What is strange is that the 24 hours and 7 days logs will show sign-in events just fine, but it seems like the 1 month logs cannot find the same events that the other time frames did.
notmyrealname 16 Reputation points

2025-12-09T18:15:48.7733333+00:00

Still issues across multiple tenants. Unsatisfactory resolution.
CB-5092 0 Reputation points

2026-01-14T12:30:06.3766667+00:00

Getting the same issue for the past 2 days, not able to download even 24 hours worth of logs - UK Tenant.

What's the point of preventing people from being able to download logs if they need to.
Jan Hansen 36 Reputation points

2026-01-20T08:01:30.23+00:00

Same Issue for swiss tenant....
Jennifer Bader 0 Reputation points

2026-11-10T17:52:27.3533333+00:00

Still having throttling issues.

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more