Microsoft service principal sign-in logs table

The Microsoft service principal sign-in logs capture service-to-service authentication events for Microsoft services in your tenant. While not necessary for security investigations, the information can be useful for understanding how your services are interacting with each other.

How to access the logs

These logs are only available by configuring diagnostic settings in Microsoft Entra to route the logs to an endpoint of your choice. For full guidance on this process, see Configure diagnostic settings.

1. Sign in to the Microsoft Entra admin center as at least a Security Administrator.
2. Browse to Identity > Monitoring & health > Diagnostics.
3. Adjust the filters accordingly.
4. Select + Add diagnostic setting.
5. Select the MicrosoftServicePrincipalSignInLogs.
6. Select the destination and subscription from the dropdown menus that appear.
7. Select the Save button.

Microsoft service principal sign-in logs

This table maps application IDs from the logs to the application name and a brief description of the application. This table is not exhaustive and will grow over time. Applications currently listed here illustrate the variety of applications that can be found in the logs.

Some application display names might include acronyms or abbreviations from previous application names. For example, some services still retain "AAD" (Azure Active Directory) in their display name, even though the service was rebranded to Microsoft Entra ID.