Get-MgAuditLogSignIn

Use Get-MgAuditLogSignIn to query Entra sign-in logs with date filters and pagination. See Microsoft.Graph module requirements and examples.

Command 1 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn — Get-MgAuditLogSignIn

Written and tested by Dhrub Bharali · Updated 02 October 2026

Common usage

Get-MgAuditLogSignIn -ErrorAction Stop

This is a usage example, not the complete parameter-set reference. Follow Microsoft Learn below for supported parameters and version details.

See the command anatomy

Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.

Get-MgAuditLogSignIn -ErrorAction Stop

Stage 1Get-MgAuditLogSignIn-ErrorAction

Try it

Windows PowerShell

PowerShell example · browser support is limited.

Execution scope: The full example below requires PowerShell outside this browser. You can edit this runner to use the supported practice commands; unsupported syntax returns an explanation.

Command

Interactive simulation · fictional data

Examples

Get-MgAuditLogSignIn -ErrorAction Stop

1Get-MgAuditLogSignIn -ErrorAction Stop

Show reference output

Sample output · fictional data, shaped like the real thing

CreatedDateTime        UserDisplayName  AppDisplayName  IPAddress      Status
---------------        ---------------  --------------  ---------      ------
2026-09-10T17:31:12Z   Adele Vance      OfficeHome      203.0.113.24   Success

Practical use and troubleshooting

Practical scenario: Use Get-MgAuditLogSignIn when you need to query Entra sign-in logs with date filters and pagination. Start with one identified target and inspect the returned values before extending the operation to a list. Keep the identity in your report so you can trace each result back to the object or path that produced it.

Common error and fix: A denied or empty log query requires checking audit-log permissions, applicable roles, licensing and retention. Confirm the time filter and tenant before concluding that no sign-ins occurred. In an unattended script, capture this failure with its original error record and record which target failed. An empty result and an unsuccessful query must remain distinguishable in the final report.

See also: Get-MgUser. Get-MgAuditLogSignIn reads sign-in records; Get-MgUser reads directory accounts. A user existing in the directory is not evidence that a sign-in succeeded or used a particular authentication method. Read the linked command before substituting it; similar names do not imply identical inputs or output.

Get-MgAuditLogSignIn reference on Microsoft Learn

Recap

Get-MgAuditLogSignIn Use Get-MgAuditLogSignIn to query Entra sign-in logs with date filters and pagination. See Microsoft.Graph module requirements and examples.

Next: Get-MgUser