Microsoft 365 sign-in logs show unfamiliar locations because Microsoft normally estimates location from the connection’s public IP address, not the user’s physical position. VPNs, mobile networks and security proxies can explain unexpected countries or cities, but compromised accounts can produce similar records.
Treat location as supporting evidence, rather than proof that a sign-in is legitimate or malicious. Start with the connection details, authentication result and surrounding activity before deciding whether to dismiss the event or contain an incident.
Key Takeaways
- Microsoft 365 sign-in locations are estimates based on public IP addresses, not a user’s physical position. VPNs, proxies, mobile networks and inaccurate geolocation data can explain unfamiliar places.
- Assess an event using its IP address, timestamp, application, device, authentication details and Conditional Access result. Correlate nearby sign-ins with employee activity and changes to mailboxes, applications, files and permissions.
- When evidence supports account compromise, block sign-in, revoke sessions and reset credentials. Review other access routes separately, since a password reset doesn’t remove every route an attacker may have established.
- Entra log retention depends on the licence, and expired records can’t be recovered by upgrading. Download records before expiry or configure diagnostic settings to send selected categories to a longer-term destination.
Why Microsoft 365 sign-in logs show unexpected places
In Microsoft 365 logs, an authentication event’s location is based on the connection’s public IP address. It doesn’t show the user’s physical position, and an unfamiliar location alone isn’t evidence of compromise.
VPNs, proxies and mobile networks
A corporate VPN can route traffic through another office or country. Cloud security proxies can also present an outbound IP address belonging to the security provider rather than the employee’s internet connection.
Mobile networks commonly use shared infrastructure, so the reported city may differ substantially from the handset’s location. Compare the recorded IP with known corporate exit addresses and the connection used at that time. Microsoft’s Conditional Access network guidance explains how network location informs access decisions.
IP geolocation and background authentication
IP geolocation databases are estimates. Address reassignment, internet provider routing and incomplete registration information can produce inaccurate results, particularly at city level.
Also distinguish interactive sign-ins from non-interactive activity. Outlook, Teams and other applications can request tokens without the user entering a password again. Several records do not necessarily mean several manual logins, and an unfamiliar background event still requires context before it can be classified.
Investigate the event before dismissing it
Assess an unfamiliar location against the IP address, timestamp, application, device, authentication details and Conditional Access result. A successful sign-in deserves more attention than a blocked attempt, but neither the location nor the status alone establishes whether an account has been compromised.
Establish what the record shows
In the Entra Admin Center, open Entra ID, then Monitoring & health, then Sign-in logs. Reports Reader is the least-privileged role for viewing Microsoft Entra activity logs.
Review the failure reason or success status, client application, resource, device information and authentication sequence. Compare timestamps using the displayed time zone and retain the event identifier.
A successful multifactor authentication (MFA) result doesn’t prove that the account owner intended the access. Authentication may rely on an existing claim, and attackers can obtain access through techniques such as Microsoft 365 device-code phishing.
Correlate identity and workload activity
Compare the event with nearby sign-ins, known travel, VPN records and the employee’s device activity. Contact the employee through an established channel rather than relying on the potentially compromised mailbox.
Then examine mailbox forwarding, inbox rules, application consent, file access and permission changes. An attacker using an authorised application may cause little obvious disruption to sign-in activity.
An unexpected location label isn’t itself a risky sign-in or an Entra ID Protection risk detection. These detections consider additional signals, and their absence doesn’t prove the activity is safe.
Contain confirmed or strongly suspected compromise
Block sign-in, revoke sessions and reset compromised credentials when the evidence supports account takeover. Preserve relevant records, but do not delay containment while preparing a complete export.
Session revocation invalidates refresh tokens, but existing access tokens can remain usable until expiry or another enforcement mechanism intervenes. Continuous Access Evaluation can shorten that window for supported services. Blocking the account does not guarantee that every session ends immediately.
Review forwarding rules, inbox rules, connected applications, authentication methods and privileged assignments separately. A password reset does not automatically remove every route an attacker may have established.
The same distinction matters when an unfamiliar event involves a former employee. Our Microsoft 365 leaver checklist separates live-access removal from permissions and data cleanup.
Document the affected account, evidence, containment actions and investigation owner. A familiar location should not override evidence of unauthorised activity elsewhere.
How long Microsoft Entra keeps the evidence
Default retention depends on the underlying Entra licence, not simply whether the business uses Microsoft 365. Short retention can remove evidence before a delayed report reaches IT.
Default audit and sign-in retention
These periods apply to standard Entra records.
| Entra licence | Sign-in logs | Audit logs |
|---|---|---|
| Free | 7 days | 7 days |
| P1 | 30 days | 30 days |
| P2 | 30 days | 30 days |
Identify the tenant’s Entra entitlement in its subscription records. Check the retention period for each relevant record type, including provisioning logs.
Microsoft 365 Business Premium includes Entra ID P1, but a Microsoft 365 subscription doesn’t automatically mean P2. Platform defaults don’t set your organisation’s own data retention policy, so check applicable compliance requirements when choosing settings.
Upgrading the licence doesn’t recover sign-in records that have already expired.
Audit logs record directory changes; sign-in logs record authentication activity. Provisioning logs cover account creation, updates and removal through provisioning processes, and their retention should be checked separately. These datasets answer different investigation questions.
Risk history and Unified Audit Log records
Microsoft’s retention table lists up to 90 days for P2 risky-sign-in history, 60 days beyond standard 30-day retention. This security-signal history doesn’t extend every ordinary sign-in record.
The Microsoft Purview Unified Audit Log is separate. Audit Standard normally retains records for 180 days; eligible Audit Premium licensing provides 1-year retention for qualifying workloads. Older references to 90-day standard retention are outdated.
Purview records Microsoft 365 workload activities, including actions that can help investigate what happened after authentication. For scripted searches, the Search-UnifiedAuditLog cmdlet can search eligible Unified Audit Log records. Availability varies by workload, so audit searches shouldn’t be treated as real-time monitoring.
Download Microsoft 365 sign-in logs before they expire
Manual downloads provide an immediate investigation copy. They don’t establish continuous collection, and an export can contain only records still available within the retention window.
Use Microsoft’s sign-in log download procedure:
- Open Entra ID, then Monitoring & health, then Sign-in logs.
- Set the date range and filters for the account, application or event being investigated.
- Select Download, then choose CSV or JSON.
- Save the file securely with the filter scope, export time and investigation reference.
CSV is convenient for spreadsheet review. JSON is useful for preserving structured properties.
For browser downloads, work below approximately 100,000 sign-in or provisioning records and 250,000 audit records. These are practical browser-download thresholds, not a guarantee that every smaller request will complete.
Split requests into shorter periods if necessary. Very large exports or repeated timeouts should use the reporting API or diagnostic settings.
Microsoft Graph access to sign-in logs requires Entra ID P1 or P2 and appropriate permissions. Use the v1.0 endpoint for production integrations rather than relying on beta behaviour.
The Office Management API is a separate route for Microsoft 365 workload audit events through the Office 365 Management Activity API. It doesn’t replace Entra authentication records.
Export logs for retention beyond 30 days
Azure Monitor can send selected Entra log categories to a Log Analytics Workspace for querying and investigation. Azure Storage supports archival retention, while Event Hubs streams records to an external security platform.
Configure collection before an incident:
- Create the destination and assign the necessary Azure permissions. Entra diagnostic configuration requires at least the Security Administrator role.
- Open Monitoring & health, then Sign-in logs, then Export Data Settings, then Add diagnostic setting. The direct configuration route is Entra ID, Monitoring & health, Diagnostic settings.
- Name the setting, select the required categories, choose the destination and save.
Include non-interactive user, service principal and managed identity activity where the investigation scope requires it. Exporting only interactive sign-ins can leave gaps.
Set retention separately after configuring collection. Microsoft’s Log Analytics retention guidance describes workspace and table controls. Analytics retention can reach 730 days, or 2 years; longer archival arrangements use different retention tiers.
Organisations with compliance requirements should check that the selected categories and retention settings meet those requirements. Log collection alone doesn’t establish compliance.
New export settings don’t reconstruct expired history. Confirm that fresh records arrive and that the selected categories match the intended coverage.
Choose storage and monitoring against the actual requirement
Log Analytics pay-as-you-go costs mainly comprise ingestion per GB and additional retention beyond the included 31 days. Log Analytics queries use KQL, the Kusto Query Language. The usual Analytics table default is 30 days, which is distinct from the billing inclusion.
There is no reliable universal conversion between event count and GB. Record size changes with event type and available fields, so budget against measured billable volume rather than employee count.
Azure Storage is appropriate when the requirement is a retained copy for later retrieval. It still incurs storage and transaction charges, and it does not provide the same query and alerting functions as Log Analytics.
Microsoft Sentinel, formerly Azure Sentinel, adds security information and event management (SIEM) capabilities, including detection and incident workflows. Microsoft Sentinel billing includes additional analysis charges, depending on the pricing model, beyond basic storage requirements.
A small business may need scheduled exports and a documented review process rather than a full SIEM. Organisations requiring continuous investigation need defined data coverage and response authority, as our managed SOC and MDR comparison explains.
Longer retention supports investigation. It does not replace monitoring.
Frequently Asked Questions
Why does a Microsoft 365 sign-in log show the wrong location?
The location is estimated from the connection’s public IP address, not the user’s physical position. VPNs, security proxies, mobile networks and IP geolocation errors can produce an unfamiliar city or country.
How should I investigate an unfamiliar sign-in location?
Review the IP address, timestamp, application, device, authentication sequence and Conditional Access result. Compare the event with nearby sign-ins and employee activity, then check for changes such as mailbox rules, application consent or file access.
How long are Microsoft Entra sign-in logs retained by default?
The standard retention period is 7 days for Entra Free and 30 days for P1 and P2. Risky-sign-in history and Microsoft Purview Unified Audit Log records have separate retention periods.
How can I keep sign-in logs for longer?
Download available records before they expire, or configure Entra diagnostic settings to send selected log categories to Log Analytics, Azure Storage or Event Hubs. Confirm that new records arrive and set retention separately for the destination.
Turn unfamiliar locations into a documented decision
Assess an unexpected location against authentication evidence and subsequent activity. Record why the event was accepted as legitimate, escalated for investigation or treated as account compromise.
Preserve the required history before the default retention window removes it. Collection, investigation and containment need separate owners and procedures.
Speak to our team about reviewing your Microsoft 365 sign-in monitoring, Conditional Access policies and log retention arrangements.
