Entra ID Failed Authentication Attempts

The question it answers: Which sign-ins failed in the last 7 days, with which error and risk level?

Note

Every sign-in of the last 7 days with an error code (all pages, filtered by Graph). MFA interrupts (50074, 50076) are not counted as failures; 50053 is shown as LockedOut, everything else (for example 50055, expired password) as Failure. Risk Level is riskLevelDuringSignIn (‘hidden’ without Entra ID P2).

At a glance

Where in the app	Entra ID › Security › Failed Authentication Attempts
Workload	Entra ID
Kind	Table
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Microsoft Entra ID P1 (sign-in logs).
Report id (API and MCP)	entra.security.failed-authentication-attempts

Columns

Column	Key	Type
User Principal Name	UserPrincipalName	Text
Created Date Time	CreatedDateTime	DateTime
Status Code	Status.ErrorCode	Text
Authentication Status	Status.AuthenticationStatus	Text
Failure Reason	Status.FailureReason	Text
Additional Details	Status.AdditionalDetails	Text
Risk Level	RiskLevel	Text

What it needs

Licence: Microsoft Entra ID P1 (sign-in logs).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• PowerShell: Get-MgAuditLogSignIn -All -Filter "createdDateTime ge (now - 7 days) and status/errorCode ne 0" (GET /v1.0/auditLogs/signIns)

Through the API and MCP

GET /ir-api/v1/reports/entra.security.failed-authentication-attempts?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.failed-authentication-attempts. The client needs the Read grant for Entra ID. See Using the API.