How to get a Microsoft 365 failed login attempts report

Failed logins in Microsoft 365 occur when a user or service principal attempts to authenticate but is denied access due to incorrect credentials, expired passwords, or conditional access policy violations. Monitoring these failures is critical for IT administrators to detect early signs of brute-force attacks or unauthorized logins from suspicious geographic locations, which can help flag these user accounts as suspicious targets and take action before it's too late.

This article will show you how to get a Microsoft 365 failed login attempts report with native tools, including the Microsoft Entra admin center and Microsoft Graph PowerShell, and with ManageEngine M365 Manager Plus, a dedicated Microsoft 365 administration tool.

Method 1: How to view failed logins using the Microsoft Entra admin center

Prerequisites

A Microsoft Entra ID user account that has at least the Reports Reader or Security Reader role assigned to it.

Steps

1. Log in to the Microsoft Entra admin center and navigate to Entra ID > Users > Sign-in logs.
2. Click Add filters and select Status.
3. Select the Status chip, choose Failure and click Apply.
4. Select a specific record to view more details such as the Sign-in error code, Failure reason, Device info, IP address, and more.

Limitations to consider

• Reviewing the Result detail of a specific sign-in failure record will help identify the exact reason for failure and can help you plan the next steps. However, you will have to retrieve every sign-in record one at a time to get the Result detail of all failed sign-ins, which can be taxing and unrealistic in large environments.
• Tracking failed sign-ins will help you identity threats in their early stages. However, you cannot schedule this sign-in failure report using the Microsoft Entra admin center.

Method 2: How to view failed logins using Microsoft Graph PowerShell (Get-MgAuditLogSignIn)

Prerequisites

1. The Reports Reader or Security Reader role must be applied to the account you use to sign in to Microsoft Graph PowerShell.
2. You must be connected to the Microsoft Graph PowerShell module.
   1. To check if the Microsoft Graph PowerShell module is installed, use this script:
      Copy

      Get-Module Microsoft.Graph -ListAvailable

      If it does not return a value, you will have to install the module.

   2. To install the Microsoft Graph PowerShell module, execute this script:
      Copy

      Install-Module Microsoft.Graph -Scope CurrentUser

   3. To connect to Microsoft Graph, run this script:
      Copy

      Connect-MgGraph -Scopes "AuditLog.Read.All"

Using Get-MgAuditLogSignIn to view failed login attempts

The Get-MgAuditLogSignIn cmdlet in Microsoft Graph PowerShell retrieves interactive and non-interactive sign-in records from Microsoft Entra ID sign-in logs.

You can use the Get-MgAuditLogSignIn cmdlet with the error code ne 0 (not equal to zero) to identify all failed login attempts in Microsoft 365 as shown in the Microsoft Graph PowerShell script below.

Get-MgAuditLogSignIn -Filter "status/errorCode ne 0" -All |
Select-Object UserDisplayName, UserPrincipalName, AppDisplayName, 
IPaddress, CreatedDateTime, Status |
Export-Csv -Path "C:\Reports\M365-FailedLogins-$(Get-Date -Format yyyyMMdd-HHmmss).csv" -NoTypeInformation -Encoding UTF8

Common Microsoft Entra ID sign-in error codes

Method 3: Track Microsoft 365 failed logins attempts using M365 Manager Plus

1. Log in to M365 Manager Plus, navigate to the Reports tab > Azure Active Directory > Other Azure Reports and select the Azure AD Logon Failures report.
2. This report displays all login failures within the selected period, including date, time, failure reason, IP address, and location.
3. Use the filter icon to narrow down results by specific attributes (e.g., a specific User Principal Name or IP).
4. Click Export As to download the report in your preferred format (CSV, PDF, HTML, or XLS).

Streamline Microsoft Entra ID user governance and group management

M365 Manager Plus provides a unified command center for managing the entire life cycle of your Microsoft Entra ID users and groups. Gain instant visibility into group memberships, ownership gaps, and orphaned objects, plus view, manage, and track identity objects across your Microsoft 365 tenant from a single console—all without switching between multiple admin portals.

Important tips

Frequently asked questions