Entra ID Sign-in Logs: Scoping a Compromised Account Using Entra ID sign-in logs to scope a compromised Microsoft account: log types, retention, key fields and a worked adversary-in-the-middle example. https://www.halkynconsulting.co.uk/a/2026/10/entra-id-sign-in-logs/