Who Can View Sign-Ins in Microsoft Entra Sign-ins Blade?
Short answer
User1, as Reports Reader, can view sign-ins for User1, User2, User3 and User4. User2, as User Administrator, can view sign-ins only for User2.
Question
You have a Microsoft 365 subscription that uses an Azure AD tenant named contoso.com. The tenant contains the users shown in the following table.
From the Sign-ins blade of the Microsoft Entra admin center, for which users can User1 and User2 view the sign-ins? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The question tests role-based access to Microsoft Entra sign-in logs, and the trap is assuming that any administrator role automatically unlocks tenant-wide sign-in reporting.
This MS-102 hotspot tests which directory roles grant read access to the Sign-ins blade in the Microsoft Entra admin center for a contoso.com tenant. It establishes that User1, holding the Reports Reader role, can view sign-ins for all four users, while User2, holding only the User Administrator role, can view sign-ins for himself alone.
Common mistake: Learners assume that because User2 is a User Administrator he can read the sign-ins of other administrators such as the Security Administrator and Global Administrator. User Administrator is a scoped directory management role that grants no Microsoft Entra ID log-read permission, so it only ever exposes the admin's own sign-in activity.
Expert Analysis
Why the Answer Is Correct
The Reports Reader role is one of the built-in roles explicitly permitted to read Microsoft Entra activity and sign-in logs across the directory, so User1 can open the Sign-ins blade and see records for User1, User2, User3 and User4. User2 holds only User Administrator, which is scoped to user and group management tasks and carries no permission to read other users' sign-in records. Because Microsoft Entra always lets a user see their own sign-in activity, User2's selection is limited to User2. This matches the widest-supported community reading of the hotspot, including cb0900's note that "User 1 - can view sign-in logs for user 1, user 2, user3, and user4."
Why Other Candidate Answers Are Wrong
The competing claim that User1 sees only his own sign-ins, or that he is blocked from administrator accounts, contradicts Microsoft's documented role matrix for activity logs: Reports Reader, Security Reader, Security Administrator, Global Reader and Global Administrator can all read tenant sign-in data. The argument that User2 can also see User1 or other standard users relies on User Administrator granting report access, which it does not — report reading requires a reports-capable role or a custom role with the sign-in log read permission. Similarly, treating Security Administrator (User3) and Global Administrator (User4) as hidden from Reports Reader reverses the actual privilege direction, since those accounts are themselves sign-in log readers rather than protected subjects. Frank9020's later revision that "User2 - can see sign in for User1 and User2" is inconsistent with the same correction he posted earlier.
Community Comment Notes
Commenters quickly flagged that the visible answer area seemed incomplete, with Khattak3143 writing "Not sure why there isn't a 5th option" and NrdAlrt arguing the User Administrator "doesn't give them access to the sign-in reports." koopb reported hands-on validation, stating "with the Reports Reade role you can see ALL sign-in logs. Also from the Global Administrators." APK1 summarized the same split by listing Global administrator, Security administrator, Security reader, Global reader and Report reader for the first selection and "Only User Admin" for the second. SemtechIT's narrower claim that Reports Reader sees only his own logs is the outlier position and should not be followed.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Before choosing, map each user to their role and ask whether that role carries Microsoft Entra ID log-read permission, not merely administrative power. Remember the baseline rule: every user can read their own sign-ins, but only reports-capable roles (Reports Reader, Security Reader, Global Reader, Security Administrator, Global Administrator) reach across the tenant.
Frequently Asked Questions
Which Microsoft Entra roles can read sign-in logs for every user in the tenant?
Does the User Administrator role allow viewing other users' sign-ins?
Discussion 12 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 12
-
cb0900 👍 21User 1 - can view sign-in logs for user 1, user 2, user3, and user4. Correct User 2 - can only view sign-in logs for user2. This isn't listed as a possible answer, suspect the options are slightly wrong. a public discussion thread on this question https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-access-activity-logs
-
NrdAlrt 👍 8Agree, the answers here don't make sense. They are only a user administrator which doesn't give them access to the sign-in reports.
-
Frank9020 👍 5User1 (Reports Reader) can view the sign-in logs for themselves and standard users (non-administrators), but not for any administrator roles (like User2, User3, or User4). User2 (User Administrator) can view the sign-in logs for themselves (User2), User1 (Reports Reader), and standard users, but cannot view the sign-ins for other administrators (like User3 (Security Administrator) or User4 (Global Administrator)).
-
Khattak3143 👍 4User1: Can view sign-in activities for all. User2: Can only see user 2's sign-in activity. Not sure why there isn't a 5th option, unless there's something I'm missing??
-
SemtechIT 👍 3Because sign‐in logs for higher‑privileged accounts (like Security Administrator and Global Administrator) are hidden from accounts with lower privileges, we get: For User1 (Report Reader): They can view only their own sign‑in logs. → Dropdown answer for User1: "User1 only" For User2 (User Administrator): They can view sign‑in logs for their own account and for accounts that are lower in privilege than themselves. In this case, that means User1 (Report Reader) and User2 (User Administrator) themselves. They would not see the sign‑in logs for User3 (Security Administrator) or User4 (Global Administrator). → Dropdown answer for User2: "User1 and User2 only"
Show 7 more comments
-
Frank9020 👍 3Given answers are correct
-
APK1 👍 2Following users can see the sign in for part one Global administrator Security administrator Security reader Global reader Report reader For part2 - Only User Admin (user admin can only see his/her sign-ins)
-
koopb 👍 2I'm sorry you are wrong on the first one. I tested this and with the Reports Reade role you can see ALL sign-in logs. Also from the Global Administrators.
-
Frank9020 👍 2User1 - can only see sign in for User1 User2 - can see sign in for User1 and User2
-
koopb 👍 2Answer is: User 1, User 2, User 3, User 4 User 1, User 2
-
ombie 👍 1Statement Correct User1 can view the sign-ins for: ✅ User1 and User2 only User2 can view the sign-ins for: ✅ User1 and User2 only
-
GMRS 👍 1Answer is: User 1, User 2, User 3, User 4 User 1, User 2, User 3, User 4
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All MS-102 Questions
Access 111 questions with complete answers and detailed explanations.
View Full MS-102 Practice Test →