Table of contents
Microsoft Logins
Login events give a reliable signal of when a user authenticates with their Microsoft 365 account. These come from Entra ID sign-in records via Microsoft's audit logs and reflect real user-driven authentication.
Login activity requires audit logging to be active for your tenant. If login events are not appearing, see Microsoft 365 Audit Log Activation.
For connection steps, see Connecting Microsoft 365.
What WorkSights Receives
WorkSights captures sign-in events with a timestamp, device information, and network metadata. Repeated sign-ins from the same user and location within a short window are collapsed into a single entry. Passwords, tokens, and credential data are never received.
Login is a system-level signal that is always on and cannot be toggled per user.
How Login Activity Appears
Login events appear as short entries marking when a user authenticated. They help clarify when a working session started and whether work happened across multiple devices or locations. Logins are contextual markers and do not contribute to scoring.
Data Notes
Microsoft does not expose session duration or active presence, so WorkSights reflects logins as discrete authentication moments rather than ongoing sessions. Background system activity and automated Microsoft operations are filtered out so only user-driven authentication events appear. Activity appears only for mapped users.
Troubleshooting
Login activity is not appearing
Confirm audit logging is active for your tenant. Login events require the Unified Audit Log. See Microsoft 365 Audit Log Activation. Also confirm the affected user is mapped in WorkSights.
Activity appears late
This is expected. Login events arrive through the audit pipeline and lag hours, not minutes.