

We’ll then change the filter for Status to only show results that are a Success:

We’ll do this by using Add filters to add a filter based on Status: Whilst unsuccessful sign-ins are a concern we will focus on successful sign-ins to gain insight into what should be real sign-ins from our users. This list is likely to show us both successful and unsuccessful sign-ins. To do this, expand the filter and from the drop-down list only select the protocols listed under Legacy authentication clients: The filter for client app will allow us to reduce the list shown to only relevant clients. Next, we’ll use Add filters to add a filter based on client app: We’ll first make sure the information we need is clearly displayed by adjusting the columns displayed by adding client app, as shown below: In this section, you will see all sign-in attempts to Azure AD, including sign-in to all Microsoft 365 services from all your clients. Learn more: Introducing Certificate-Based Authentication for Exchange Online Remote PowerShell with Microsoft MVP Vasil Michev

To do this, navigate to the Azure AD portal and then select Sign-ins under Monitoring. You can do this in the Azure Active Directory portal by reviewing sign-in logs using dedicated capabilities to filter based on legacy authentication. Reviewing legacy sign-ins to Exchange Onlineīefore disabling legacy authentication for Exchange Online, it is essential to ensure that clients won’t be affected or prevented from signing in, or if they will, gather enough information so that you can inform people who will be impacted.
