AllowNow
How-To Guides/Microsoft Entra ID Audit Reports
Microsoft Entra ID 45–90 min depending on licence tier · SOC 2 CC6 · ISO 27001 A.5.18

How to Generate an Access Audit Report in Microsoft Entra ID

Microsoft Entra ID (formerly Azure AD) is the identity provider for Microsoft 365, Azure, and every SAML/OIDC-connected application in your stack. Unlike Google Workspace, Entra has several distinct export paths depending on your licence tier — P1 vs P2 changes what's available. This guide covers all of them: manual exports, PowerShell via Microsoft Graph, and the native Access Reviews feature (P2). Every step maps to specific audit evidence requirements.

Prerequisites

  • Entra ID role: Global Administrator or, at minimum, Security Reader + User Administrator
  • For Privileged Identity Management (PIM): Privileged Role Administrator role
  • Microsoft 365 E3/E5 or Entra ID P1/P2 licence (P2 unlocks native Access Reviews — see Step 4)
  • PowerShell 7+ and the Microsoft.Graph module installed (for scripted exports)
  • Our free SOC 2 Access Review Template to paste your findings into

What evidence you'll produce

  • • All-users export with sign-in activity, MFA status, account type (member vs guest) — CC6.3
  • • Privileged role assignments (Global Admin, Privileged Role Admin, User Admin, etc.) — CC6.1
  • • Sign-in logs for the review period (last 90 days) — CC6.3 activity evidence
  • • Audit logs showing role assignment changes — CC6.2 provisioning evidence
  • • Completed access review records (P2) or populated spreadsheet (P1) — CC6.3 primary evidence
1

Export all users from Entra ID

10 minutes

Via the Admin Center (manual):

  1. Navigate to portal.azure.com → Microsoft Entra ID → Users → All users
  2. Click Download users (top of the user list)
  3. Wait for the file to generate — it will appear in your Downloads as a .csv

Via Microsoft Graph PowerShell (recommended for automation):

# Install the module if needed

Install-Module Microsoft.Graph -Scope CurrentUser

# Connect with required scopes

Connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All"

# Export all users with key audit fields

Get-MgUser -All -Property DisplayName,UserPrincipalName,AccountEnabled,`

UserType,SignInActivity,AssignedLicenses,`

StrongAuthenticationMethods | `

Select-Object DisplayName,UserPrincipalName,AccountEnabled,UserType,`

@{n="LastSignIn";e={$_.SignInActivity.LastSignInDateTime}} |`

Export-Csv -Path "entra-users-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Key columns to review:

  • AccountEnabled: False = disabled account. Verify each disabled account was intentionally deactivated — not just orphaned.
  • UserType: Member (internal) vs Guest (external collaborators, contractors). Guest accounts are a common gap — they often persist after contractor engagements end.
  • LastSignIn: Your stale account signal. No sign-in in 90+ days = potential stale access.
Guest accounts are the most common gap: Filter UserType = Guest separately and review each one. These are external contractors, partners, or consultants. Auditors specifically ask for your external user review because companies routinely leave guest accounts active for months after the engagement ends.
2

Export privileged role assignments

15–20 minutes

Via the Admin Center:

portal.azure.com → Microsoft Entra ID → Roles and administrators → Click each role → Assignments

The highest-risk roles to document: Global Administrator, Privileged Role Administrator, User Administrator, Security Administrator, Exchange Administrator, SharePoint Administrator.

Via PIM (Privileged Identity Management) if available (P2):

portal.azure.com → Privileged Identity Management → Azure AD roles → Assignments → Active assignments → Export

PIM distinguishes between permanent role assignments and eligible assignments (which require manual activation). Best practice: all admin roles should be eligible (time-limited activation) rather than permanent.

Via PowerShell (most complete view):

# Get all role assignments with user and role name

Connect-MgGraph -Scopes "RoleManagement.Read.Directory", "Directory.Read.All"

Get-MgRoleManagementDirectoryRoleAssignment -ExpandProperty "principal,roleDefinition" | `

Where-Object {$_.Principal -ne $null} | `

Select-Object `

@{n="User";e={$_.Principal.DisplayName}},`

@{n="UPN";e={$_.Principal.AdditionalProperties.userPrincipalName}},`

@{n="Role";e={$_.RoleDefinition.DisplayName}},`

@{n="DirectoryScopeId";e={$_.DirectoryScopeId}} | `

Export-Csv -Path "entra-role-assignments-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

SOC 2 CC6.1 — what auditors check: Global Administrator count (should be 2–4 maximum), whether admin roles are time-bounded via PIM, whether each admin has a documented justification, and whether MFA is enforced for all admin accounts via Conditional Access.
Common mistake: Only reviewing permanent role assignments and missing eligible (PIM) assignments. An eligible assignment means the person can activate Global Admin on demand — that's still privileged access that needs reviewing.
3

Export sign-in and audit logs

10–15 minutes + retention planning

Sign-in logs (for the current review period):

portal.azure.com → Microsoft Entra ID → Monitoring → Sign-in logs → Filter by date range → Download → Download CSV

Filter on the current review period (e.g., last 90 days). Use this to verify last-login dates and look for sign-ins from unusual locations or devices.

Audit logs (role changes and user lifecycle events):

portal.azure.com → Microsoft Entra ID → Monitoring → Audit logs

Key activities to filter on: Add member to role, Remove member from role, Create user, Delete user, Reset user password. This is your CC6.2 provisioning chain evidence — it shows who made each change and when.

Via PowerShell:

# Export audit log entries for role assignments in last 90 days

$start = (Get-Date).AddDays(-90).ToString("yyyy-MM-ddTHH:mm:ssZ")

Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Add member to role' and activityDateTime ge $start" | `

Select-Object ActivityDisplayName,ActivityDateTime,`

@{n="InitiatedBy";e={$_.InitiatedBy.User.UserPrincipalName}},`

@{n="TargetUser";e={($_.TargetResources | Where-Object Type -eq "User").UserPrincipalName}},`

@{n="Role";e={($_.TargetResources | Where-Object Type -eq "Role").DisplayName}} |`

Export-Csv -Path "entra-role-changes-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Critical — log retention: Entra ID P1 retains sign-in logs for 30 days, P2 for 90 days. A SOC 2 Type II audit covers 12 months. If you don't archive logs, you will be unable to provide evidence for the first 9–11 months of your audit period. Fix: configure Diagnostic Settings to export logs to a Log Analytics Workspace or Azure Storage Account now — don't wait until audit time.
4

Run a structured access review (P2) or manual review (P1)

15–30 minutes to set up · reviewer time varies

Option A: Entra ID P2 — Native Access Reviews

  1. Navigate to portal.azure.com → Identity Governance → Access reviews → New access review
  2. Review scope: Choose "Teams + Groups" (for M365 groups) or "Azure AD roles" (for privileged role review)
  3. Reviewers: Select "Group owner" or "Manager of user" — not "Self-review" for privileged accounts (segregation of duties)
  4. Recurrence: Set to quarterly (every 90 days). This auto-creates future review instances.
  5. On completion: Select "Auto apply results to resource" — this automatically removes access for users marked as Denied
  6. When the review period ends, download the results via Access review → [review name] → Results → Download

The downloaded CSV is direct, auditor-ready evidence of a completed CC6.3 periodic review — with reviewer name, decision, and timestamp per row.

Option B: Manual review (P1 or no licence)

  1. Use the exported user list from Step 1 and role assignments from Step 2
  2. Paste into the access review template with one row per user-role pair
  3. Share with the appropriate system owner (Exchange Admin for Exchange roles, SharePoint Admin for SharePoint roles)
  4. They confirm: access still needed and appropriate? Set status to Approved, Revoked, or Escalated
  5. Document reviewer name and date in every row
5

Configure long-term log retention (do this now)

20–30 minutes — one-time setup

This step is often skipped until it's too late. Set it up before your audit window opens.

Option A: Log Analytics Workspace (recommended)

  1. Create a Log Analytics Workspace in portal.azure.com → Log Analytics Workspaces → Create
  2. Navigate to Entra ID → Monitoring → Diagnostic settings → Add diagnostic setting
  3. Select: SignInLogs, AuditLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs
  4. Destination: Send to Log Analytics workspace → select your workspace
  5. Set retention to 90 days in the workspace (or longer in Azure Storage for cold archival)

Option B: Azure Storage Account (cheaper for long-term)

  1. Create a Storage Account in the same subscription
  2. In Diagnostic Settings: Destination → Archive to a storage account
  3. Set retention days to 365 (1 year) for all log categories
  4. Logs export as JSON files per day — use Azure Storage Explorer to browse them
Why this matters for audits: If your SOC 2 Type II audit covers January–December 2025, you need sign-in logs for that entire 12-month period. Without archival, you can only provide the last 30 or 90 days. This is one of the most common evidence gaps for Microsoft-first companies.
6

Organise your evidence folder

10 minutes

Create a folder per review cycle: Entra-Review-2025-Q1/ containing:

  • entra-all-users-2025-01-10.csv — includes AccountEnabled, UserType, LastSignIn
  • entra-guest-users-2025-01-10.csv — filtered to UserType = Guest
  • entra-privileged-roles-2025-01-10.csv — all role assignments
  • entra-role-changes-Q4-2024.csv — audit log for role assignment changes in the prior 90 days
  • access-review-entra-2025-Q1.xlsx — completed review with Approved/Revoked decisions
  • Screenshots/ — any screenshots taken during revocations

Auditors will sample 2–3 review cycles. Keep 4+ quarters of this folder structure available.

Evidence quality checklist

  • User export covers all accounts including guests and service accounts
  • Privileged role export covers PIM-eligible assignments (not just permanent)
  • Every admin row has a documented business justification
  • Sign-in logs cover the full review period (not just the last 30 days)
  • Audit logs cover all role changes in the review period
  • Log archival is configured — Diagnostic Settings are active and logs land in storage
  • Review uses appropriate reviewers (no self-review for privileged accounts)
  • Zero rows left as Pending at review close
  • Revocation screenshots attached for all Revoked rows
  • Next review date is in the calendar

Run structured Entra ID access reviews

AllowNow gives you a structured place to record your Entra ID user and role assignments, run periodic access reviews, and produce audit-ready evidence without manual PowerShell exports. Every approval and revocation is logged with reviewer and timestamp — ready for your auditor.

Start your free review