Office 365 login report
A sign-in from a hosting network at 03:00. Whose was it, and what let it in?
A raw sign-in log is a timestamp and an IP address. In a typical tenant, hundreds of sign-ins a week come from VPNs, hosting networks or countries nobody in the company lives in - and an IP address alone cannot tell you which ones. 1Security resolves every sign-in to a country, city and network, joins the device that carried it, reads the Conditional Access verdict, and keeps it all for up to three years.
The problem
A sign-in log tells you when. You need where, and from what.
A sign-in export gives you a timestamp and an IP address. Then the reading starts: paste the IP into a lookup site, guess whether the ISP is a home connection or a rented server, and hope the device column means what you think it means. And a review that only reaches a few weeks back cannot answer a question from three months ago.
There is a trap most admins hit in the first week: many cloud actions arrive stamped with a service relay address instead of the user's own. Read the raw log and it looks like half your company works from a datacenter abroad. Teams either learn to ignore "foreign" sign-ins - or spend hours chasing phantom ones.
The device column is no better. A sign-in from an enrolled, compliant laptop and a sign-in from a machine your directory has never met look identical in an export. The second kind is exactly the one you were looking for.
In practice
One list. Where, from what device, under which policy.
How a login review runs in 1Security - no lookup sites, no CSV, no guessing.
- 01
Open Activity logs and filter to sign-ins
Pick a user, a date range, a country or a network type. Every row is a sign-in with its resolved location - country, city and the network behind it (home ISP, mobile carrier, corporate, cloud provider). Sort and filter live, export the whole list when the auditor wants the file.
- 02
Read the real origin, not the relay
Service relay traffic is recognised and labelled as such, VPN, Tor and hosting networks are called out, and the first time a user ever appears in a new place is flagged as first seen. In a typical mid-size tenant that turns thousands of IP rows into a few dozen named places you can actually read.
- 03
See the device on the same row
Each sign-in is joined to a device: enrolled and compliant, unregistered, or a shadow device that only ever showed up in activity. Filter to "unregistered device" and you get the machines that never enrolled - typically dozens in a tenant of a few hundred users - as a complement to what Intune already manages.
- 04
Check which policy governed it
The per-sign-in Conditional Access verdict travels inside the records 1Security ingests. The report shows which sign-ins completed with no policy in force at all - as a share of the tenant's traffic and per location - so the "are we actually covered" question is a number, not a hope.
What makes it work
Three parts of the platform, one login report.
The login report is a view over the same enriched activity every other screen in 1Security reads. Each part is documented in depth.
Locations
Country, city and network for every action, VPN / Tor / datacenter / Microsoft called out, first-seen detection and impossible-travel verdicts - resolved locally, no third-party lookup service.
See the feature →Conditional Access coverage
Your declared policies laid over the sign-ins actually observed: a coverage verdict per location and the share of traffic that walked in ungoverned.
See the feature →Devices, including unenrolled ones
Every sign-in joined to a device identity - registered, unregistered or shadow - with a real last-seen taken from activity, refreshed as the device is used.
See the feature →
FAQ
Common questions.
Do I need Entra ID P2 or the premium sign-in log add-on?
No. Location and device enrichment run inside 1Security on the records a standard tenant already produces, and history is kept for up to three years on a standard license. The one Microsoft-side prerequisite is that Conditional Access itself needs Entra ID P1 - if your tenant does not have it, the report still works, only the policy column stays empty.
Why does my current report show sign-ins from US datacenters?
Because many cloud actions carry a service relay address instead of the user's. 1Security recognises those ranges, labels that traffic as relay rather than as a foreign login, and prefers the real-country signal the sign-in record carries where it is available. A genuine sign-in from a rented server abroad stays fully visible.
How far back does the report go?
Up to three years of retained activity on a standard license - go from a few weeks of sign-in history to three years. A login review can cover the whole period an auditor asks about, and "last sign-in" per user comes from actual activity, refreshed as it happens.
Can I get last-login per user, not just a log?
Yes. The Users screen carries last sign-in and last activity per account, sortable - "last sign-in ascending" is the fastest way to find the accounts that should not exist any more, and it is the same one-click filter behind the dormant-account cleanup.
The 1Security platform
Office 365 Login Report is just the beginning
Office 365 Login Report is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Security scoreThe score, its history, the controls behind it and the benchmarks, so the number on the board report means something.
- ComplianceNIS2, DORA, GDPR, EU AI Act, SOC 2 and HIPAA as requirements with a live status, attestations, dated snapshots and evidence packs.
- ReportsSix report types in PDF, PowerPoint, HTML, CSV and JSON, under your brand with the client’s name, one report per client across the whole book.
- AlertingInstant and digest channels per client, routed to the right people, themed under your brand or theirs.
- Trends and the daily briefWhat moved this month, what needs a decision today, ranked, for the client meeting and for your own morning.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Stop pasting IP addresses into lookup sites.
Connect read-only and see your sign-ins with the city, the device and the policy verdict on every row the same day - and three years of them from then on.
Or keep guessing what an IP address means, row by row.