How to download logs in Microsoft Entra ID

The Microsoft Entra admin center gives you access to three types of activity logs:

• Sign-ins: Information about sign-ins and how your resources are used by your users.
• Audit: Information about changes applied to your tenant such as users and group management or updates applied to your tenant’s resources.
• Provisioning: Activities performed by a provisioning service, such as the creation of a group in ServiceNow or a user imported from Workday.

Microsoft Entra ID stores activity logs for a specific period, depending on your license. For more information, see Microsoft Entra data retention. By downloading the logs, you can control how long logs are stored. This article explains how to download activity logs in Microsoft Entra ID.

Prerequisites

• A working Microsoft Entra tenant with the appropriate Microsoft Entra license associated with it.
  • For a full list of license requirements, see Microsoft Entra monitoring and health licensing.
• The option to download logs is available in all editions of Microsoft Entra ID.
• Downloading logs programmatically with Microsoft Graph requires a premium license.
• Reports Reader is the least privileged role required to view Microsoft Entra activity logs.

Log download considerations

Before you download logs, review the following considerations and tips:

• Microsoft Entra ID supports the following formats for your download:
  • CSV
  • JSON
• Timestamps in the downloaded files are based on UTC.
• You can download up to 100,000 sign-in or provisioning records per file.
• You can download up to 250,000 audit records per file.
• Set your filter before you download the logs to narrow the dataset.

Note

The Microsoft Entra admin center download service will time out if you attempt to download large data sets. Generally, data sets smaller than 250,000 for audit logs and 100,000 for sign-in and provisioning logs work well with the browser download feature.

If you face issues completing large downloads in the browser, use the reporting API to download the data or send the logs to an endpoint through diagnostic settings.

Note

The columns in the downloaded logs do not change. The output contains all details of the audit or sign-in log, regardless of the columns you customized in the Microsoft Entra admin center. If you set a custom filter, however, the output in the downloaded logs contain only the results that match the filter.

How to download activity logs

You can access the activity logs from the Monitoring and health section of Microsoft Entra ID or from the area of Microsoft Entra ID where you're working.

For example, if you're in the Groups or Licenses section of Microsoft Entra ID, you can access the audit logs for those specific activities directly from that area. When you access the audit logs in this way, the filter categories are automatically set. If you're in Groups, the audit log filter category is set to GroupManagement.

Audit logs

Tip

Steps in this article might vary slightly based on the portal you start from.

1. Sign in to the Microsoft Entra admin center as at least a Reports Reader.

2. Browse to Identity > Monitoring & health > Audit logs.

3. Select Download.

4. In the panel that opens, select the Format.

5. Optionally provide a unique file name.

6. Select the Download button. The download processes and sends the file to your default download location.

   

Sign-in logs

The options covered in this section align with the preview experience for sign-in logs.

1. Sign in to the Microsoft Entra admin center as at least a Reports Reader.

2. Browse to Identity > Monitoring & health > Sign-in logs.

3. Select the Download button and select either JSON or CSV.

   

4. Optionally provide a unique file name for each file you need to download.

5. Select the Download button for one or more of the logs. The download processes and sends the file to your default download location.

   • Interactive sign-ins
   • Interactive sign-ins with only the authentication details included
   • Non-interactive sign-ins
   • Non-interactive sign-ins with only the authentication details included
   • Application sign-ins
   • Managed identity

   

Provisioning logs

1. Sign in to the Microsoft Entra admin center as at least a Reports Reader.

2. Browse to Identity > Monitoring & health > Provisioning logs.

3. Select the Download button and select either JSON or CSV.

4. Optionally provide a unique file name for each file you need to download.

5. Select the Download button for one or more of the logs. The download processes and sends the file to your default download location.

   • Provisioning logs
   • Provisioning logs with the provisioning steps
   • Provisioning logs with modified properties