AuditLog.Read.All
— application permission, granted to the app registration with admin consent.
Licence: Microsoft Entra ID P1.
Endpoint:
GET /beta/auditLogs/signIns?$filter=signInEventTypes/any(t: t eq 'servicePrincipal') (7 days)
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Failing App Sign-ins
Apps and scripts that keep trying to sign in with an expired secret, an invalid certificate or a deleted registration. Each row is an integration that is already broken - or a leaked, rotated secret someone is still trying.
No app sign-in failed in the last 7 days.