Lab 12: Entra Sign-In Logs, MFA and SSPR Support

Overview

This lab extended the delegated identity administration model from Lab 11 into practical sign-in troubleshooting and recovery. The earlier Microsoft 365 labs established the cloud identity baseline, MFA readiness and pilot group model; this work used those foundations to investigate a user sign-in failure and configure a controlled SSPR rollout.

The scenario uses Kate Jones as the affected standard user and Chloe Bennett as the delegated helpdesk context from the previous lab. The work demonstrates both troubleshooting evidence and configuration evidence: failed sign-in logs, detailed error analysis, successful recovery, SSPR pilot scoping, authentication method policy, registration settings, notification settings, audit logs and user authentication method validation.

Objective

The objective was to show how a Microsoft 365 support analyst can investigate user sign-in failure, confirm the cause through Entra logs, validate successful recovery, and reduce future helpdesk dependency by enabling SSPR for a small pilot group.

Environment

Configuration and Evidence

1. Failed Kate Jones Sign-In Events Filtered

I filtered Entra sign-in events for Kate Jones and confirmed repeated failed interactive sign-ins to One Outlook Web.

Context: Filtering sign-in logs by user and date reduces noise and gives first-line support a clear starting point before resetting passwords or escalating.

2. Sign-In Failure Detail Reviewed

I opened the failed sign-in event and reviewed the basic details. The failure reason showed that the credentials were not valid.

Context: Error code 50126 supports a credential-focused recovery path rather than a Conditional Access, licensing or service availability escalation.

3. Successful Sign-In Confirmed After Recovery

After the account recovery action, I refreshed the sign-in logs and confirmed a successful Kate Jones sign-in above the earlier failed attempts.

Context: A successful follow-up sign-in validates the fix and gives the ticket a clean closure point.

4. SSPR Enabled for a Pilot Group

I enabled Self-Service Password Reset for the dedicated pilot group GRP_SSPR_Pilot rather than enabling it tenant-wide.

Context: A pilot group allows SSPR to be tested safely with selected users before wider rollout.

5. Authentication Methods Policy Reviewed

I reviewed the tenant authentication methods policy and confirmed Microsoft Authenticator, Temporary Access Pass, Software OATH tokens and Email OTP were enabled for all users, while SMS and voice call were not enabled.

Context: SSPR scope and authentication method availability are separate controls: the group controls who can use SSPR, while the authentication methods policy controls what methods users can register and use.

6. SSPR Registration Policy Configured

I configured users in scope to register when signing in and set authentication information reconfirmation to 90 days.

Context: Requiring registration at sign-in helps ensure pilot users are ready before they need to recover access under pressure.

7. SSPR Notification Policy Confirmed

I confirmed that users are notified on password resets and that admins are notified when other admins reset their password.

Context: Reset notifications improve visibility and help users or administrators detect unexpected account recovery activity.

8. SSPR Audit Log Validated

I checked the SSPR audit log and confirmed successful Update SSPR Settings events for the configuration changes.

Context: Audit evidence proves the configuration change was recorded and can be reviewed later during support, governance or security checks.

9. Kate Jones Authentication Method Confirmed

I checked Kate Jones' authentication methods and confirmed Microsoft Authenticator was available as a usable method with Microsoft Authenticator notification as the default sign-in method.

Context: User-level method validation confirms the recovery and MFA readiness state for the affected account, not just the tenant-level policy.

Validation

The troubleshooting path was validated when Kate Jones' failed sign-ins were visible in Entra sign-in logs, the failed event showed error code 50126, and a later sign-in showed successful access after recovery.

The SSPR rollout was validated when password reset was scoped to GRP_SSPR_Pilot, supported authentication methods were visible in the authentication methods policy, registration and notification settings were configured, successful SSPR policy updates appeared in audit logs, and Kate Jones had Microsoft Authenticator available as a usable method.

Key Technical Outcomes

This lab demonstrated practical Microsoft Entra sign-in troubleshooting, including filtered sign-in log review, event-level error analysis and post-fix validation.

It also demonstrated a staged SSPR rollout using a dedicated pilot group, supported authentication methods, registration enforcement, reset notifications and audit-log validation.