Q16 RBAC Domain 4 · 20–25% of exam

What information is captured in a Microsoft Entra ID sign-in log that is useful for security investigations?

  1. A Resource creation events
  2. B User sign-in details: IP address, location, app, status, MFA result, Conditional Access policy applied (correct answer)
  3. C Azure resource modifications
  4. D Key Vault access events

Shortcut: Entra ID Sign-in logs capture authentication attempts with IP, location, device, application, authentication method, success/failure, and which Conditional Access policies were evaluated/applied.