Viewing Failed Microsoft 365 Sign-In Attempts
Short answer
B Use the Microsoft Entra admin center to access Sign-in logs, which display failed authentication attempts and their specific error codes.
Question
You discover that some users cannot sign in to Microsoft 365.
You need to view the failed Microsoft 365 sign-in attempts.
What should you use?
Key Takeaways
Identity sign-in logs are housed in Microsoft Entra ID, not in general M365 administration or security portals.
Learn how to locate failed Microsoft 365 sign-in attempts using the Microsoft Entra admin center's Sign-in logs for identity troubleshooting.
Common mistake: Selecting the Microsoft 365 admin center because it is the central hub; however, it lacks the detailed authentication failure logs found in Entra ID.
Expert Analysis
The question asks specifically where to view failed Microsoft 365 sign-in attempts. This is a fundamental identity and access management task within the Microsoft ecosystem. The correct tool for this is the Microsoft Entra admin center (formerly Azure Active Directory), which provides detailed Sign-in logs that include status, failure reasons, IP addresses, and Conditional Access results.
Option A, the Microsoft Defender portal, focuses on threat detection and response (XDR) rather than primary identity sign-in auditing. Option C, the Microsoft Purview portal, is dedicated to data governance, compliance, and information protection, not identity authentication logs. Option D, the Microsoft 365 admin center, manages tenant-wide service health and user licenses but does not provide granular sign-in audit logs with failure details.
The provided comments correctly identify Option B as the answer, citing the "Sign-in logs" feature in the Identity section of the Microsoft Entra admin center. These logs explicitly track successful and failed attempts, making it the definitive source for this troubleshooting step.
Exam Strategy
When asked about identity-related queries like sign-ins, passwords, or conditional access, immediately look for Microsoft Entra ID tools. Do not confuse them with general tenant management (M365 Admin Center) or data security (Purview/Defender). Memorize that 'Sign-in Logs' belong to Entra ID.
Frequently Asked Questions
What details are included in Microsoft Entra sign-in logs?
Can I see failed sign-ins in the Microsoft Defender portal?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
deca0d4 👍 3 Answered Bto view failed Microsoft 365 sign-in attempts, you normally go to the Microsoft Entra Admin Center Users → select a user → Sign-in logs or Identity → Monitoring & health → Sign-in logs failed sign-ins successful sign-ins MFA failures risky sign-ins device/location info IP addresses conditional access results
-
pbpd91 👍 1 Answered BCopilot said: In Microsoft Entra ID, you can view the Sign-in logs, which include: Successful and failed sign-in attempts. The user who attempted to sign in. The application or resource accessed. Date, time, and location. Reason for the failure. Information related to MFA and Conditional Access.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.