4.1 Two Tables, Not One

Two Tables, Not One

The single most important thing to understand about Entra ID sign-in investigation is that the data lives in two tables, not one. Missing either table means missing half the picture.

Figure 4.1: The two sign-in tables. Attackers using stolen tokens appear only in the non-interactive table — missing it means missing the compromise.

Why two tables matter for investigation

In a legitimate session, both tables record activity: the user signs in interactively (SigninLogs), then the applications refresh tokens in the background (AADNonInteractiveUserSignInLogs). Both entries come from the same IP, the same device, the same location. This is normal.

In a token theft attack, the pattern splits. The legitimate user’s interactive sign-in appears from their normal location. The attacker’s token replay appears as a non-interactive sign-in from a completely different IP and location — because the attacker is using the stolen token directly, not signing in through a login page.

The volume difference

Non-interactive sign-ins vastly outnumber interactive sign-ins — often 10:1 or more. Every time Outlook refreshes a token, every time Teams checks for new messages, every time SharePoint pre-loads a document library — each of these generates a non-interactive sign-in event. This is why the tables are separate: combining them would make the interactive sign-ins (which are usually more important for investigation) nearly impossible to find in the noise.

A practical pattern: query both tables together

When investigating a specific user, always check both tables:

1
2
3
4
5
6
7
8
9

let targetUser = "j.morrison@northgateeng.com";
let lookback = 7d;
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(lookback)
| where UserPrincipalName =~ targetUser
| extend SignInType = iff(Type == "SigninLogs", "Interactive", "Non-Interactive")
| project TimeGenerated, SignInType, IPAddress, AppDisplayName, ResultType,
    tostring(LocationDetails.countryOrRegion), tostring(DeviceDetail.browser)
| sort by TimeGenerated desc

The union operator combines both tables. The iff expression adds a column showing which table each row came from. This gives you the complete sign-in picture for a user in a single query.