Can Entra ID provide sign-out logs for enterprise applications?
Asked by
MistyHarbor42
I can access sign-in logs for Entra enterprise applications, but I also need sign-out information for some KPIs. Is there a reliable way to determine when a user signed out of a specific application, or how long they remained signed in?
Answers
The application itself is often the best source. If it records login, logout, session-expiration, and activity events, those logs can be used to estimate session duration. Entra sign-in logs alone cannot reliably tell you when a user stopped using an app.
Reply to this answer
You can enforce a sign-in frequency through Conditional Access and use the resulting reauthentication pattern as an approximation, but it still will not measure the exact time a user was signed in. In many cases the token simply expires, rather than generating a distinct sign-out event.
Reply to this answer
Check whether the application has a logout URL configured. It is optional, and many applications do not provide one. Even when it is configured, the resulting data may not reliably represent when the user stopped using the app.
Reply to this answer
Usually not. A sign-out is only visible to Entra ID when the application explicitly performs a logout flow and calls the identity provider. Closing a browser or app does not count as signing out, so it generally produces no sign-out event.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MistyHarbor42: That makes sense. I was hoping Entra had a dependable event for this, but it sounds like I need to rely on application telemetry or treat sign-in frequency as an estimate.