I can access sign-in logs for Entra enterprise applications, but I also need sign-out information for some KPIs. Is there a reliable way to determine when a user signed out of a specific application, or how long they remained signed in?
2 Answers
You can enforce a sign-in frequency through Conditional Access and use the resulting reauthentication pattern as an approximation, but it still will not measure the exact time a user was signed in. In many cases the token simply expires, rather than generating a distinct sign-out event.
The application itself is often the best source. If it records login, logout, session-expiration, and activity events, those logs can be used to estimate session duration. Entra sign-in logs alone cannot reliably tell you when a user stopped using an app.
That makes sense. I was hoping Entra had a dependable event for this, but it sounds like I need to rely on application telemetry or treat sign-in frequency as an estimate.