M365 Sign-in Review
Load a Microsoft Entra ID sign-in log export and see the account-takeover signals in seconds: impossible travel, password spraying, legacy authentication, MFA fatigue, risky sign-ins, scripted clients and logins from countries your users never work from.
● Runs in your browser. The sign-in log never leaves your device.Sign-in log export
Findings
Load a sign-in export and press Analyze.
Users
Riskiest firstCountries
What it looks for
Account takeover
Impossible travel between countries, successful sign-ins from countries outside your normal footprint, risky sign-ins flagged by Entra ID Protection.
Credential attacks
Password spraying across many users, brute force on one user, smart lockouts, and repeated MFA failures that suggest push bombing.
Weak paths in
Legacy authentication (IMAP, POP, SMTP, ActiveSync), sign-ins with no MFA, device code flow, ROPC and scripted user agents like python-requests.
The M365 Posture Scanner signs in read-only and grades MFA, admins, Conditional Access, app consents and email security.