Entra ID // Account investigations

Someone asks what this account did. Can you answer before the logs are gone?

HR, legal or management needs to know what happened with an account. Entra ID keeps sign-in history for only 7 or 30 days, and raw logs are not an answer they can read. We turn the history into a clear report they can use.

Ask about an account See the options

ACCOUNT ACTIVITY // SUMMARY SAMPLE

PeriodLast 30 days
Successful sign-ins412
Countries3 (1 unusual)
Devices2 (1 unmanaged)
Applications used14
Outside working hours9%

One sign-in from an unmanaged device in another country, at 02:14 on a Saturday.

The problem

The question always comes at the wrong time.

An employee leaves on bad terms. An account signs in from somewhere it should not. A manager suspects misuse. Someone needs facts about one account, and they need them now.

The clock is runningEntra ID keeps sign-in history for 7 or 30 days, depending on the licence. After that, the evidence is gone.

Raw logs are not an answerThousands of rows with IDs and codes. HR and legal cannot read them, and they should not have to.

IT becomes the detectiveDays of exporting and spreadsheet work, on top of the day job, for a result nobody fully trusts.

Who asks

The question rarely comes from IT.

// HR

An employee is leaving or under review. What did they access in their last weeks?

// LEGAL

A dispute or a claim. What can we show, and can we stand behind it?

// SECURITY

An account looks compromised. When did it start, and what was touched?

// AUDIT

An auditor wants proof of who signed in where. Screenshots will not do.

Two ways to work with us

One question, or every question.

Order a report when a question comes up, or agree in advance so the answer is ready when you need it. If you are not sure which fits, get in touch.

01 // ONE ACCOUNT

Account Activity Report

Price on request Request pricing →

Like reading a flight recorder. You see what actually happened, not what someone remembers.

Sign-ins, locations, devices and applications for the period you need.
Unusual activity pointed out, not hidden in thousands of rows.
A written summary HR, legal or management can read without IT.
Facts, not judgements. The report shows what happened and leaves the conclusions to you.

Ask about an account →

02 // AGREED IN ADVANCE

Investigations on Call

Price on request Request pricing →

When the question comes, the answer is already on its way.

Access and scope agreed once, so nothing waits for approvals on the day.
Work starts while the sign-in history still exists, not after it is gone.
Reports on request for any account in your organisation.

Discuss an agreement →

The difference

Doing it yourself vs asking us.

Doing it yourself

Exports and spreadsheets, spread over days
Raw rows HR and legal cannot read
Unusual activity easy to miss
History gone before anyone gets to it
IT's own judgement in the middle of a sensitive case

Asking LakeForest

One report, ready to hand over
A summary written for non-IT readers
Unusual activity pointed out
Work starts before the history runs out
A neutral outside view

FAQ

Questions worth asking.

What do you need from us?

Read-only access to your Entra ID sign-in data for the account and period in question, and one contact person on your side.

How far back can you look?

Entra ID keeps sign-in history for 30 days with Entra ID P1 or P2, and 7 days without them. If your sign-in logs also go to Microsoft Sentinel, we can look back as far as your retention settings allow. Otherwise it pays to ask early.

Do you tell us whether the employee did something wrong?

No. The report shows what happened with the account. Decisions about people stay with you, your HR and your lawyers.

Contact

Start with a 30-minute call.

Tell us which account and what happened. We will tell you what can still be found and how quickly.

We work remotely with teams worldwide, in English.

LakeForest Technologies