I can access sign-in logs for enterprise applications in Microsoft Entra ID, but I also need sign-out data for some KPIs. Specifically, I want to estimate how long users remain signed in to a particular application. Is there a reliable way to retrieve sign-out events or calculate session duration?
3 Answers
Check whether the application has a logout URL configured. It’s optional, and many applications don’t populate it, so Entra may never receive a notification when the user signs out. If the application records its own session events, its logs are likely the best source for actual sign-out times.
You could enforce a sign-in frequency through a Conditional Access policy and use recurring authentication as an approximate boundary for session length. However, this still won’t measure true usage duration, because token expiration, inactivity, browser closure, and application-specific sessions can all behave differently.
Usually not reliably. A sign-out is only visible to Entra ID when the user explicitly logs out and the application sends a logout request or callback to the identity provider. Closing a browser or app, losing a session, or simply allowing a token to expire generally does not create a sign-out event.
Right—this ultimately depends on the application implementing logout and logging the event. Entra sign-in logs alone can’t determine exactly when a user stopped using the app.