Cloud Access Trails
Azure Entra ID audit logs
Sign-in events & directory audit
IntegraTrace collects audit logs from Azure Entra ID via Microsoft Graph, giving you visibility into authentication events, directory changes, and administrative actions.
Data source
Microsoft Graph — Entra ID sign-in logs and directory audit logs.
Events captured
Application and service-principal sign-ins, directory changes, and admin actions on users and groups.
Required permissions
AuditLog.Read.All on Microsoft Graph (admin consent required).
Identity types
Service principals, managed identities, and user accounts.
Audit log types
Sign-in logs
Authentication events including user sign-ins, service principal authentications, and managed identity token acquisitions, with success/failure context.
Directory audit logs
Changes to your Entra ID directory: user management, group changes, application registrations, and role assignments.
What we track for each event
Principal
Service principal ID and name, or user principal name (UPN) of the identity that acted.
Activity & target
The operation performed (e.g. sign-in, update user, add member) and the target resource or application.
Location context
Source IP address, geographic location, and device information when available.
Status & result
Timestamp, success/failure status, error codes, and detailed failure reasons.
Key use cases
Detect compromised service principals
Monitor sign-ins for unusual patterns, geographic anomalies, or access to unexpected resources.
Track failed authentication
Identify failed sign-in patterns that may indicate brute force, password spraying, or compromised credentials.
Monitor privilege changes
Track role assignments, group memberships, and application permissions to detect unauthorized escalation.
Investigate geographic anomalies
Detect impossible-travel scenarios where one identity signs in from distant locations within a short window.
Need to configure access? Follow the Azure setup guide to grant the required permissions.