Sign-in KQL builder

Pick your filters and get a ready-to-run KQL query for Entra sign-in logs in Log Analytics or Microsoft Sentinel.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Sign-ins

Time range

User or app identity (contains)

Application (contains)

Result

Error code

Conditional Access

Country code (e.g. GB)

IP address

Output

Query

Needs sign-in logs sent to a Log Analytics workspace through Entra diagnostic settings. More ready-made queries are in the KQL library, and error codes are explained in the error code guides.