Skip to main content

Configuring Microsoft Entra ID Sign-in Logs Collection

Introduction​

Open iT collects Microsoft Entra ID sign-in logs data and sends it over to the server.

This will produce the following aggregated data types used for historical reporting:

warning

Apply the configurations shown in the Open iT Core Client.

Requirements​

Configuring Microsoft Entra ID Sign-in Logs Collection​

Step 1: Open Command Prompt​

  1. Open a command prompt with Administrator level privileges.

Step 2: Navigate to the bin Directory​

  1. Go to the bin directory, which is by default in C:\Program Files\OpeniT\Core\bin, run the command:

    Command Syntax
    cd <bin_dir>
    Example
    cd C:\Program Files\OpeniT\Core\bin

Step 3: Activate Microsoft Entra ID Sign-in Logs Collection​

  1. Run the following command to enable Microsoft Entra ID sign-in logs collection:

    Command Syntax
    openit_oconfinit -u "collect_usage_signinazure.root.scheduler.jobs.collect_azure_signins.general.active=true"

Step 4: (Optional) Activate Collection for a Specific Microsoft Entra ID Account​

If you configured multiple Microsoft Entra ID accounts and want to collect sign-in logs from a specific account, include the --name argument followed by the configured account name.

Run the following command:

Command Syntax
openit_oconfinit -u "collect_usage_signinazure.root.scheduler.jobs.collect_azure_signins.operations.arguments=azure collect signinlogs --output \"${Openit.directories.temp)/IdpConnector/Azure/SigninLogs/{1900epoch}-{pid}.data\" --name <name>"

where <name> is the name of the account you want to use for data collection.

Example
openit_oconfinit -u "collect_usage_signinazure.root.scheduler.jobs.collect_azure_signins.operations.arguments=azure collect signinlogs --output \"${Openit.directories.temp)/IdpConnector/Azure/SigninLogs/{1900epoch}-{pid}.data\" --name azure1"

Verifying Data Collection​

After configuration, you can verify that the Microsoft Entra ID sign-in logs are collected by following these steps:

Step 1: Open Command Prompt​

  1. Open a command prompt with Administrator level privileges.

Step 2: Navigate to the bin Directory​

  1. Go to the bin directory, which is by default in C:\Program Files\OpeniT\Core\bin, run the command:

    Command Syntax
    cd <bin_dir>
    Example
    cd C:\Program Files\OpeniT\Core\bin

Step 3: Run the Sign-in Logs Collection Command​

  1. Execute the following command:

    Command Syntax
    openit_idpconnectorconsole azure collect signinlogs --output "C:\ProgramData\OpeniT\data\temp\IdpConnector\Azure\SigninLogs\{1900epoch}-{pid}.data"

Step 4: Verify the Output File​

  1. Navigate to C:\ProgramData\OpeniT\data\temp\IdpConnector\Azure\SigninLogs.
  2. Verify that the file with the name format, {1900epoch}-{pid}.data, is created.

Sample Report​

Hourly Application Sign-in Status per User​

This report provides a detailed view of user authentication activity per hour, including sign-in status, accessed applications, authentication methods, and event counts.

It offers several key benefits:

  • Centralized Sign-in Visibility – Delivers a clear overview of user login activity across applications, helping track access patterns in one place.
  • Authentication Monitoring – Shows whether sign-ins use single-factor or multi-factor authentication (MFA), supporting stronger security enforcement.
  • Failed Login Detection – Highlights unsuccessful and interrupted sign-in attempts, enabling quick identification of potential security risks.
  • User Activity Insights – Reveals when and how users access systems, helping analyze behavior and peak usage periods.
  • Application Access Tracking – Identifies which applications are frequently accessed, supporting usage analysis and resource planning.
  • Security & Compliance Support – Provides auditable records of authentication activity to support security reviews and compliance requirements.
  • Faster Incident Investigation – Enables efficient tracing of login events for troubleshooting and security incident response.

Hourly Application Sign-in Status per User

Hourly Application Sign-in Status per User