Get Entra ID App Usage Report in M365

Are you looking for insights on how users are accessing and using Azure AD apps within Microsoft 365? Understanding Azure AD application activity is crucial for optimizing both performance and security. The Microsoft Entra ID application activity report allows admins to track user engagement with Azure AD apps, detect unusual behavior, and ensure compliance. This guide will walk you through obtaining and interpreting this report, helping you strengthen security within Microsoft 365.

Native Solution

Microsoft 365 Permission Required

High

Least Privilege

Reports Reader

Highest Privilege

Global Admin

Option 1 Using Microsoft Entra Admin Center

Sign in to the Microsoft Entra admin center.
Navigate to Azure AD Application Activity (Preview) under Identity»Monitoring & health»Usage & insights.
Use the Date range drop-down to filter the Azure AD app sign-in summary for the past 7 days or 30 days.

This report provides insights into the number of successful and failed sign-ins, as well as the overall success rate for logins to Azure AD applications.
Note: Utilize the Download option available in the report to export it as a CSV file.

Option 2 Using Windows PowerShell

Connect to the Microsoft Graph PowerShell module using the cmdlet below.

Windows PowerShell

 Connect-MgGraph -Scopes "Reports.Read.All"

Next, run the following cmdlet, replacing <Report Period> with values like 'D7' or 'D30' to retrieve the Azure AD application sign-in summary for the last 7 or 30 days.

Windows PowerShell

 Get-MgBetaReportAzureAdApplicationSignInSummary -Period <Report Period>

The output displays a summary of Azure AD application sign-ins, including counts of successful sign-ins, failed sign-ins, and sign-in interruptions for the specified period.

AdminDroid Solution

More than 150 reports are under the free edition.

AdminDroid Permission Required

Delegated

Any user with report access delegated by the Super Admin.

StepsUsing AdminDroid

Open the AdminDroid Office 365 reporter.
Navigate to the Organization Sign-In Count based on Application report under Analytics»Sign-in Analytics»Organization Sign-in Summary.

This comprehensive report provides detailed insights into Azure application usage within your Microsoft 365 environment, helping admins identify and resolve issues that lead to sign-in interruptions.

admimdroid-detailed-chartview-for-signin-analytics

Leverage the built-in charts to visually display the top Azure AD applications, categorized by sign-in successes, failures, and more, to monitor each application's usage over a specified period.

Explore a full range of reporting options

Daily usage analysis of Entra ID apps!

AdminDroid Microsoft 365 reporting enables you to analyze daily summaries of Azure application usage without limitations, whereas the Entra portal provides data only for the past week or month.

Witness the report in action using the

Live Demo

Important Tips

Enforce strong authentication on app sign-ins by applying Conditional Access policies to applications within Entra ID, thereby enhancing your security posture.

Migrate apps from AD FS to Microsoft Entra ID to enhance security and reduce the risk of malicious actions, as AD FS lacks modern authentication.

By managing user consent to applications, you can gain greater control over how they access and interact with your organization's data.

Azure ADUnlock In-Depth Insights and Reports on Azure AD Application Usage in Microsoft 365

Showing 1 of 4

How to audit service principal sign-in activity in Azure AD? How to find applications with too many failed sign-ins in Azure AD? How to get Entra ID app registrations with expiring secrets and certificates? How to disable user sign-ins to applications in Entra ID?

How to audit service principal sign-in activity in Azure AD?

Service principal sign-ins refer to the authentication and activity logs associated with the identities used by Entra ID applications to access resources within Microsoft 365 services. When a service principal signs in, it performs actions such as accessing APIs, managing resources, or performing tasks on behalf of an application.

Monitoring these sign-ins helps track records of both successful and failed attempts, providing insight into whether the service principal is being used correctly or if potential security issues exist.

Monitor service principal sign-in logs using the Microsoft Entra admin center

Navigate to Service principal sign-ins under Identity »Monitoring & health»Sign-in logs.
The service principal sign-in logs provide information such as sign-in status, service principal name, resource ID, sign-in date and time, IP address, conditional access, and more.

Note: To obtain a comprehensive summary of each application's service principal sign-in, navigate to the Service principal sign-in activity report under Identity»Monitoring & health»Usage and insights.

Track service principal sign-ins with AdminDroid for more detailed analytics.

AdminDroid’s sign-in by apps and service principals report offers granular insights, including detailed sign-in time, application names, geographical data, and more.
The built-in heatmap chart helps you quickly spot peak activity and low sign-in days, making it easier to detect unusual service principal usage patterns.

How to find applications with too many failed sign-ins in Azure AD?

Monitoring sign-in failures is essential for smooth operation within Microsoft 365. By identifying and understanding the top sign-in errors for Azure AD apps, admins can proactively troubleshoot issues such as application logins failing to meet conditional access policies, application-related issues, and more. This helps ensure the security and reliability of their organization's digital resources.

Track top Azure AD app sign-in failures using the Microsoft Entra admin center

Navigate to Sign-in logs under Identity »Applications»Enterprise applications»Activity.
Adjust the Date filter as needed. In the Add filters option, choose the Status field, and choose Failure from the Status drop-down.
Click on the Application column header to sort the report by app.

Note: You can also set the filter to Success or Interrupted from the Status drop-down to analyze those sign-ins for Azure AD applications.

The graphical chart in AdminDroid’s ‘Organization Sign-In Count by Application’ report allows you to easily visualize the top apps by failed sign-ins with just a few clicks.

admindroid-organization-failed-sign-In count-graph

How to get Entra ID app registrations with expiring secrets and certificates?

The application credential activity report offers a centralized view of your application credentials, detailing the last activity date, credential type (certificate or client secret), and expiration dates. Monitoring credential expiration dates is essential to ensure that the credentials of registered applications and service principals are up to date.

Monitor application credential activity using the Microsoft Entra portal

Navigate to the Application credential activity (Preview) report under the Usage & insights tab.
Utilize the 'View more details' link available in the respective record to access information such as the application object, service principal, resource IDs, credential origin, and more.

app-credential-activity-entra-admin-center

While the Entra portal provides insights into client secret expiration, tracking changes to credentials on service principals remains crucial!

AdminDroid's Credential Changes report provides a detailed audit of service principal credential operations, allowing you to track changes like added or removed credentials.
This report offers insights into event time, operation type, user ID, and target ID, helping you manage credential updates for smooth operations.

Pro tip: Utilize the Schedule option to receive the service principal changes report periodically to your mailbox.

How to disable user sign-ins to applications in Entra ID?

Disabling user sign-ins for applications in Entra ID is a crucial step for managing application access and ensuring security. This process allows administrators to control which applications users can access, either temporarily or permanently, based on organizational needs or security policies. By default, user sign-ins for applications are enabled.

Disable user sign-in for an Azure AD application

Navigate to the Identity »Applications»Enterprise applications»All applications.
Select the application you want to disable user sign-ins for. Then, go to the Properties tab.
Disable the 'Enabled for users to sign-in?' toggle, then click Save.

Disable user sign-in for an Entra ID application using PowerShell

Run the below PowerShell cmdlet to disable user sign-in for an Azure AD application.

Connect-MgGraph -Scopes "Application.ReadWrite.All"
$servicePrincipal = Get-MgServicePrincipal -Filter "appId eq '<App ID>'"
Update-MgServicePrincipal -ServicePrincipalId $servicePrincipal.Id -AccountEnabled:$false

Replace the <App ID> with the client ID of the target application.

View all service principals with disabled sign-ins

Run the below cmdlet, to list all the enterprise applications where user sign-in is disabled.

Get-MgServicePrincipal -Filter "accountEnabled eq false"

AdminDroid Microsoft 365 Usage AnalyticsEffortlessly explore insights on Microsoft Entra Application Usage Activity!

AdminDroid’s Microsoft 365 Sign-in Analytics tool offers comprehensive reports on sign-in events, allowing you to monitor Azure application insights and log analytics throughout your organization. It efficiently displays sign-ins by apps and service principals, details on non-interactive user sign-ins, and information on users' last log-on time by application, each with a dedicated report.

A Quick Summary

Receive Real-Time Alerts for Azure App Sign-In Failures

To mitigate security risks, set up alerts and establish thresholds for failed sign-ins in Azure AD applications. This way, you will be notified when the number of failed sign-in attempts surpasses a specified limit.

Audit All Entra ID App Operations

Frequently audit Azure AD app operations to identify new configurations and permissions that might inadvertently expose sensitive data or allow unauthorized access.

Analyze Azure Apps' Non-Interactive Sign-Ins

Track non-interactive sign-ins performed by client apps to identify and address potential unauthorized access attempts using certificates or client secrets.

Regular Updates on Azure AD App Sign-In Logs

Schedule the 'Organization Sign-in Count based on Application' report on a monthly or weekly basis to ensure the reports are delivered to the respective admins consistently.

Track User Sign-In Summary by Application

Use the User Sign-In Summary by Application report to get a comprehensive view of successful and failed user sign-ins for all applications in your organization.

Explore CA Policies Applied to Entra ID Apps

Regularly review conditional access policies on Entra ID apps to ensure that only users who fulfill the security to applications.

In summary, AdminDroid's Azure AD management tool goes beyond basic application audit logs by categorizing third-party applications and offering unparalleled visibility. This empowers admins to stay informed about application activities and manage their organization’s resources more effectively.

Kickstart Your Journey with AdminDroid

Your Microsoft 365 Companion with Enormous Reporting Capabilities!

Download

Common Errors and Resolution Steps While Tracking Azure AD Application Usage Report

The following are possible errors and troubleshooting hints for analyzing Azure AD application activity reports.

Error: Get-MgBetaReportAzureAdApplicationSignInSummary : One or more errors occurred.

This error occurs when you try to run the beta cmdlet without installing Microsoft Graph Beta module.

Troubleshooting hint :You can use the below cmdlets to install the Microsoft Graph Beta module and then connect to it.

Install-Module Microsoft.Graph.Beta

Error: Get-MgBetaReportAzureAdApplicationSignInSummary : Calling principal does not have required MSGraph permissions Reports.Read.All.

This error occurs in PowerShell when you execute the ‘Get-MgBetaReportAzureAdApplicationSignInSummary’ cmdlet without having the necessary permission.

Troubleshooting hint :Connect to the MS Graph PowerShell with the “Reports.Read.All” permission and try executing the cmdlet.

Connect-MgGraph -Scopes "Reports.Read.All"

Error: Error AADSTS7000112 - Application is disabled.

This error occurs when you try to sign in to an Azure AD application whose service principal object is disabled.

Troubleshooting hint :Go to the Entra admin center and enable the service principal object for the respective application.

Error: Get-MgBetaReportAzureAdApplicationSignInSummary : Parameter 90 is not a valid period parameter.Valid parameter are D7, D30.

This error occurs when the value for the period parameter is not specified correctly.

Troubleshooting hint :Use the supported values, such as D7 or D30, as shown below.

Get-MgBetaReportAzureAdApplicationSignInSummary –Period D7

Delivering Reports on Time

Want a desired Microsoft 365 reports every Monday morning? Ensure automated report distribution and timely delivery with AdminDroid’s Scheduling to your email anytime you need.

Schedule tailored reports to execute automatically at the time you set and deliver straight to the emails you choose. In addition, you can customize report columns and add intelligent filtering to the activities just from the previous day to suit your Microsoft 365 report requirements.

Set It, Schedule It, See Results - Your Reports, Your Way, On Your Time!

Time Saving Automation Customization Intelligent Filtering

Give Just the Right Access to the Right People

Grant fine-tuned access to any Microsoft 365 user with AdminDroid’s Granular Delegation and meet your organization’s security and compliance requirements.

Create custom roles loaded with just the right permissions and give access to admins or normal users within AdminDroid. The result? A streamlined Microsoft 365 management experience that aligns your organization's security protocols and saves your invaluable time and effort.

Give Just the Right Access to the Right People

Align, Define, Simplify: AdminDroid's Granular Delegation

Smart Organizational Control Effortless M365 Management Simplified Access

Advanced Alerts at a Glance

Receive quick notifications for malicious Microsoft 365 activities. Engage with the AdminDroid’s real-time alert policies crafted to streamline your security investigations.

Stay informed of critical activities like suspicious emails and high-risk logins, bulk file sharing, etc. Through creating and validating ideal alert policies, AdminDroid provides a comprehensive approach to real-time monitoring and management of potential threats within your organization.

AdminDroid Keeps You Always Vigilant, Never Vulnerable!

Proactive Protection Real-time Monitoring Security Intelligence Threat Detection

Merge the Required Data to One Place

Combine multiple required columns into one comprehensive report and prioritize the information that matters most to you with AdminDroid’s Advanced Column Customization.

This column merging capability offers a flexible way to add different columns from various reports and collate all the essential data in one place. Want to revisit the customized report? Save it as a 'View’, and your unique report is ready whenever you need it.

Merge with Ease and Save as Views!

Custom Reporting Unique View Desired Columns Easy Data Interpretation

Insightful Charts and Exclusive Dashboards

Get a quick and easy overview of your tenant's activity, identify potential problems, and take action to protect your data with AdminDroid’s Charts and Dashboards.

With AdminDroid charts and dashboards, visualize your Microsoft 365 tenant in ways you've never thought possible. It's not just about viewing; it's about understanding, controlling, and transforming your Microsoft 365 environment.

Insightful Charts and Exclusive Dashboards

Explore Your Microsoft 365 Tenant in a Whole New Way!

Executive overviews Interactive insights Decision-making Data Visualization

Efficient Report Exporting for Microsoft 365

Downloading your reports in the right file format shouldn’t be a hassle with AdminDroid’s Report Export. Experience seamless report exporting in various formats that cater to your needs.

Navigate through diverse options and export Microsoft 365 reports flawlessly in your desired file format. Tailor your reports precisely as you need them and save them directly to your computer.

Efficient Report Exporting for Microsoft 365

Take Control, Customize and Deliver- Your Office 365 Data, Exported in Your Way!

Easy Export Seamless Downloading Data Control Manage Microsoft 365

How to Export Azure AD Application Usage Report in Microsoft 365