"For troubleshooting MFA, Conditional Access, and risky sign-ins, admins typically combine Sign-in logs (to see per-attempt details and applied…

Sign-in logs provide per-attempt details (applied MFA/Conditional Access), while Risky sign-ins and Risky users reports expose identity-protection triggers. Microsoft’s troubleshooting guidance explicitly recommends correlating those logs and user-specific views instead of relying on generic usage reports.

No alternative options were supplied for evaluation.

1. Microsoft Learn – “Troubleshoot multifactor authentication with sign-in logs

” steps 1-3 (learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-reporting#troubleshoot-with-sign-in-logs)

2. Microsoft Learn – “Investigate risk” §“Use Risky sign-ins with Sign-in logs” (learn.microsoft.com/en-us/entra/id-protection/howto-investigate-risk)

3. MIT OpenCourseWare – “Enterprise Cloud Security

” Lecture 6 notes

p.9

endorses combining per-sign-in and risk reports.