Entra sign-in log triage

Paste or drop a sign-in log export (CSV or JSON) from the Entra admin center, or a Log Analytics export of SigninLogs or AADNonInteractiveUserSignInLogs. The page counts failures by result code, links each code to its page on this site, and runs a few simple pattern rules.

This is a heuristic helper, not a detection product. The flags show their exact rule and thresholds so you can judge them; treat a match as a reason to look closer, never as a verdict.

Privacy: this page runs in your browser; nothing is sent anywhere. Your file is not uploaded, stored or logged, and the page makes no network requests while you use it. For the site itself, see the Datenschutz page.

Your export

Choose or drop a CSV / JSON file

Or paste the export here

Thresholds for the heuristic rules

Spray: distinct users per IP (N)

Brute force: 50126 failures per user

Brute force: distinct IPs

Lockout wave: distinct users

Lockout wave: window (minutes)

MFA flood: rows per user

MFA flood: window (minutes)

Supported columns

Source	Code	IP	User	Time
Entra admin center CSV	`Sign-in error code`	`IP address`	`Username` (then `User`)	`Date (UTC)`
Entra admin center JSON	`status.errorCode`	`ipAddress`	`userPrincipalName`	`createdDateTime`
Log Analytics	`ResultType`	`IPAddress`	`UserPrincipalName`	`TimeGenerated`

If your columns are named differently, use the column mapper after loading the file. Up to about 50,000 rows are handled in one pass; the hard limit is 250,000 rows.

The patterns are explained in the guides: password spraying and MFA fatigue. The tool uses its own quick thresholds for a single export file, for example 5 or more MFA rows (500121, 50074 or 50076) for one user within 10 minutes. The guides’ KQL and the Sentinel rule use their own starting points, such as 3 or more 500121 or 50074 rows per hour.