Unit 6: Analyze Microsoft Entra workbooks and reporting

Microsoft Entra ID provides built-in reporting and workbooks that help administrators understand how applications are being used and how authentication is behaving across the organization. These reports provide an application-centric view of sign-in activity, allowing security and operations teams to quickly identify trends, failures, and potential issues.

One of the most important reports for application monitoring is the Usage and insights report.

What is the Usage and insights report?

The Usage and insights report focuses on application sign-in behavior rather than individual users. It helps administrators answer key operational and security questions, such as:

• Which applications are most actively used in the organization.
• Which applications experience the highest number of failed sign-ins.
• What the most common sign-in errors are for each application.

This report is especially useful for:

• Troubleshooting authentication issues.
• Identifying misconfigured applications.
• Monitoring adoption and usage patterns.

Prerequisites

To access the Usage and insights report, the following requirements must be met:

• A Microsoft Entra tenant must exist.
• A Microsoft Entra ID P1 or P2 license is required.
• The user must be in one of the following roles:
• Security Administrator.
• Security Reader.
• Report Reader.
• Any non-admin user can view their own sign-in activity only.

Access the Usage and insights report

Follow these steps to open the report:

• Navigate to the Azure portal.
• Select the correct directory.
• Select Microsoft Entra ID.
• Select Enterprise applications.
• In the Activity section, select Usage and insights.

The report opens and displays application sign-in data.

How to use the Usage and insights report

The Usage and insights report displays a list of applications that have had one or more sign-in attempts within the selected time range.

Available insights include:

• Number of successful sign-ins.
• Number of failed sign-ins.
• Overall sign-in success rate per application.

You can sort the list to quickly identify:

• The most used applications.
• Applications with high failure rates.
• Applications that may require investigation or remediation.

Viewing more applications

• Selecting Load more at the bottom of the list displays additional applications.
• You can adjust the date range to view application usage within a specific time period.

This allows administrators to analyze both short-term incidents and long-term usage trends.

Focus on a specific application

You can drill down into a single application to investigate its authentication behavior in more detail.

To view detailed activity:

• Select an application.
• Choose View sign-in activity.

This view shows:

• Sign-in activity over time.
• Top sign-in errors associated with the application.

When you select a specific day in the application usage graph:

• A detailed list of sign-in activities for that day is displayed.
• This helps correlate authentication issues with configuration changes or incidents.

Exam-focused summary (Unit 6)

• Usage and insights provides an application-centric view of sign-ins.
• Requires Microsoft Entra ID P1 or P2.
• Used to identify:
• Most used applications.
• Applications with high failure rates.
• Common sign-in errors.
• Accessed through Enterprise applications → Usage and insights.
• Supports:
• Sorting.
• Date filtering.
• Application-specific drill-downs.